Search results

[New Rule] Unusual Kill Signal

backport: auto

Domain: Endpoint

OS: Linux

Rule: NewProposal for new ruleProposal for new rule

Team: TRADE

Status: Open (in progress).

elastic/detection-rulesnumber 4911

#4911 In elastic/detection-rules;

· Aegrah opened on Jul 16, 2025

[New Rule/Tuning] Linux User or Group Deletion/Creation

backport: auto

Domain: Endpoint

OS: Linux

Rule: NewProposal for new ruleProposal for new rule

Team: TRADE

Status: Open (in progress).

elastic/detection-rulesnumber 4861

#4861 In elastic/detection-rules;

· Aegrah opened on Jun 30, 2025

[New Rule] Kubectl Secret Access

container

OS: Linux

Rule: NewProposal for new ruleProposal for new rule

Team: TRADE

Status: Draft (not ready).

elastic/detection-rulesnumber 4834

#4834 In elastic/detection-rules;

· Aegrah opened on Jun 19, 2025

[New Rule] Potential Impersonation Attempt via Kubectl

backport: auto

container

Domain: Endpoint

OS: Linux

Rule: NewProposal for new ruleProposal for new rule

Team: TRADE

Status: Open (in progress).

elastic/detection-rulesnumber 4833

#4833 In elastic/detection-rules;

· Aegrah opened on Jun 19, 2025

[New Rule] Kubernetes Unusual Decision by User Agent

backport: auto

Integration: KubernetesKubernetes IntegrationKubernetes Integration

OS: Linux

Rule: NewProposal for new ruleProposal for new rule

Team: TRADE

Status: Open (in progress).

elastic/detection-rulesnumber 4829

#4829 In elastic/detection-rules;

· Aegrah opened on Jun 19, 2025

[Meta] Evaluate Metadata for Linux Ruleset

Meta

OS: Linux

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#4754 In elastic/detection-rules;

· Aegrah opened on May 30, 2025

[FR] Pre-Built Elastic Auditd Ruleset

enhancementNew feature or requestNew feature or request

OS: Linux

Security Content

Team: TRADE

Status: Open.

Enhancement

#4713 In elastic/detection-rules;

· Aegrah opened on May 9, 2025

[New] Potential SAP NetWeaver Exploitation rules

backport: auto

OS: Linux

OS: Windowswindows related ruleswindows related rules

Rule: NewProposal for new ruleProposal for new rule

Status: Open (in progress).

elastic/detection-rulesnumber 4666

#4666 In elastic/detection-rules;

· Samirbous opened on Apr 26, 2025

[New Rule] Elastic Agent status not validated

backlog

Domain: Endpoint

esqlES|QLES|QL

OS: Linux

OS: macOS

OS: Windowswindows related ruleswindows related rules

Rule: NewProposal for new ruleProposal for new rule

Status: Open.

#3719 In elastic/detection-rules;

· peasead opened on May 29, 2024

[Meta] Linux Active Directory Tooling detection

backlog

Meta

OS: Linux

Team: TRADE

Status: Open.

#3523 In elastic/detection-rules;

· w0rk3r opened on Mar 20, 2024

Review Linux and macOS rules for Endgame compatibility

backlog

OS: Linux

OS: macOS

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Status: Open.

#2369 In elastic/detection-rules;

· Mikaayenson opened on Oct 18, 2022

[New Rule] Potential SSH Hijacking

backlog

OS: Linux

OS: macOS

Rule: NewProposal for new ruleProposal for new rule

Status: Open.

#2364 In elastic/detection-rules;

· DefSecSentinel opened on Oct 18, 2022