Pull requests: elastic/detection-rules
Pull requests list
[Rule Tuning] AWS STS Role Assumption by User
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
#5796
opened Feb 27, 2026 by
imays11
Loading…
[New Rule] M365 SharePoint Site Sharing Policy Weakened
backport: auto
Domain: Cloud
Domain: SaaS
Integration: Microsoft 365
Rule: New
Proposal for new rule
#5795
opened Feb 27, 2026 by
terrancedejesus
Loading…
3 of 5 tasks
[New] Elastic Defend Alert from GenAI Utility or Descendant
backport: auto
Rule: New
Proposal for new rule
#5793
opened Feb 27, 2026 by
Samirbous
Loading…
[Bug] Ignore Other Keep Wildcards
backport: auto
bug
Something isn't working
patch
python
Internal python for the repository
#5792
opened Feb 26, 2026 by
eric-forte-elastic
Loading…
5 tasks
[Rule Tuning] Entra ID OAuth Device Code Grant by Unusual User
backport: auto
Domain: Cloud
Domain: Identity
Integration: Azure
azure related rules
Rule: Tuning
tweaking or tuning an existing rule
#5791
opened Feb 26, 2026 by
terrancedejesus
Loading…
5 tasks
[New] Suspicious Execution from VS Code Extension
backport: auto
Domain: Endpoint
OS: Windows
windows related rules
Rule: New
Proposal for new rule
#5786
opened Feb 26, 2026 by
Samirbous
Loading…
[Rule Tuning] AWS Access Token Used from Multiple Addresses
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
#5785
opened Feb 25, 2026 by
imays11
Loading…
[FR] Minor Typo Fixes
backport: auto
documentation
Improvements or additions to documentation
Domain: Cloud
Domain: Endpoint
Hunting
Integration: Microsoft 365
OS: Windows
windows related rules
patch
Rule: Tuning
tweaking or tuning an existing rule
#5784
opened Feb 25, 2026 by
eric-forte-elastic
Loading…
5 tasks
[New Rules] New Terms rules for malicious Python/Pickle model activity on macOS
backport: auto
Domain: Endpoint
OS: macOS
Rule: New
Proposal for new rule
#5780
opened Feb 25, 2026 by
DefSecSentinel
Loading…
[New] Potential Account Takeover - Logon from New Source IP
backport: auto
Domain: Endpoint
OS: Windows
windows related rules
Rule: New
Proposal for new rule
#5770
opened Feb 24, 2026 by
Samirbous
Loading…
[Bug] [DAC] Add filtering to export-rules-from-repo
backport: auto
bug
Something isn't working
detections-as-code
patch
python
Internal python for the repository
#5769
opened Feb 24, 2026 by
eric-forte-elastic
Loading…
5 tasks
[Bug] KQL Validation Add Wildcard w/ Space token value
backport: auto
bug
Something isn't working
patch
python
Internal python for the repository
Team: TRADE
#5753
opened Feb 20, 2026 by
imays11
Loading…
5 tasks done
[Rule Tuning & Deprecation] Tuning & Deprecating Promotion Rule
backport: auto
Integration: Cloud Defend
Cloud Defend Integration
Rule: Deprecation
removal of a rule
Rule: Tuning
tweaking or tuning an existing rule
Team: TRADE
[New Rule] AWS API Activity from Uncommon S3 Client by Rare User
backport: auto
Domain: Cloud
Integration: AWS
AWS related rules
Rule: New
Proposal for new rule
Team: TRADE
[FR] [DAC] Add Exception Duplication Checking
backport: auto
detections-as-code
enhancement
New feature or request
patch
python
Internal python for the repository
#5689
opened Feb 5, 2026 by
eric-forte-elastic
Loading…
5 tasks
[New Rule] Kubernetes Anonymous User Bound to ClusterRole
container
Integration: Kubernetes
Kubernetes Integration
Rule: New
Proposal for new rule
Team: TRADE
[New Rule] Potential Service Masquerading
backport: auto
Domain: Endpoint
OS: Linux
Rule: New
Proposal for new rule
Team: TRADE
#5650
opened Jan 29, 2026 by
Aegrah
Loading…
[Hunt Tuning] Fix Invalid ES|QL Syntax in Hunting Queries
backport: auto
Hunt: Tuning
Hunting
#5566
opened Jan 16, 2026 by
terrancedejesus
Loading…
5 tasks
[New Rule] Multiple High-Severity Alerts for Privileged AD User
backport: auto
Domain: Endpoint
OS: Windows
windows related rules
Rule: New
Proposal for new rule
ProTip!
Updated in the last three days: updated:>2026-02-24.