elastic/detection-rules

View on GitHub

Stars: 2.7k
Forks: 696
Open beginner issues: 0
Indexed issues: 140
Avg merge: 5d 1h
Merged PRs (30d): 72

Dominant language: Python
License: No license data
Last GitHub push: Sep 15, 2026
Latest indexed: Sep 15, 2026
Contributing guide: Contributing guide
Code of conduct: No code of conduct
Beginner labels: No beginner labels indexed

Open All

140 open issues indexed

[New Rule] Potential AWS Credential Exposure Open

backlog Integration: AWS Rule: New v7.14.0

elastic/detection-rules#955 · 1 comment · 1 reaction · 1 assignee · Indexed Sep 15, 2026
[New Rule] TLS Traffic Intercept on MacOS Open

backlog Rule: New

elastic/detection-rules#1177 · 1 comment · 0 reactions · 1 assignee · Indexed Sep 15, 2026
[New Rule] Kubernetes Secrets Enumeration Open

backlog Rule: New v8.3.0

elastic/detection-rules#1188 · 10 comments · 0 reactions · 1 assignee · Indexed Sep 15, 2026
[New Rule] Kubernetes ServiceAccount Creation Open

backlog Rule: New v8.3.0

elastic/detection-rules#1189 · 3 comments · 0 reactions · 1 assignee · Indexed Sep 15, 2026
[New Rule] Kubernetes Activity by system:anonymous Open

backlog Rule: New v8.3.0

elastic/detection-rules#1190 · 6 comments · 0 reactions · 1 assignee · Indexed Sep 15, 2026
[New Rule] Pre-OS Boot: Bootkit Open

backlog community Rule: New

elastic/detection-rules#1210 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Review use of non-ecs-schema Open

backlog schema v8.2.0 v8.7.0

elastic/detection-rules#1776 · 6 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
[New Rule] AWS - possible compromised access keys [ML] Open

backlog community Domain: Cloud Workloads Integration: AWS ML Rule: New

elastic/detection-rules#1919 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
[FR] Add details and export options for dev package-stats command Open

backlog enhancement python

elastic/detection-rules#2020 · 4 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
[New Rules] Cisco ASA Open

backlog Rule: New

elastic/detection-rules#2176 · 2 comments · 0 reactions · 1 assignee · Indexed Sep 15, 2026
[New Rule] Multiple Okta MFA push requests were denied Open

backlog Rule: New

elastic/detection-rules#2304 · 5 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
[New Rule] Azure AD Multiple MFA Sign-in Failures For Single User Open

backlog community Domain: Cloud Workloads Integration: Azure Rule: New

elastic/detection-rules#2317 · 3 comments · 0 reactions · 1 assignee · Indexed Sep 15, 2026
[FR] Create Unit Test for non-ecs-schema.json Open

backlog enhancement python

elastic/detection-rules#2322 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 15, 2026
[New Rule] Potential SSH Hijacking Open

backlog OS: Linux OS: macOS Rule: New

elastic/detection-rules#2364 · 1 comment · 0 reactions · 1 assignee · Indexed Sep 15, 2026
Review EQL schema generation logic to minimize duplication Open

backlog schema

elastic/detection-rules#2370 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
[FR] Attack Navigator layer from ndjson export Open

backlog community enhancement

elastic/detection-rules#2389 · 0 comments · 0 reactions · 1 assignee · Indexed Sep 15, 2026
[New Rule] Successful Azure AD MFA fatigue attack Open

backlog community Domain: Cloud Workloads Integration: Azure Rule: New

elastic/detection-rules#2440 · 1 comment · 0 reactions · 1 assignee · Indexed Sep 15, 2026
[FR] Update Rule Versioning to Semantic Versioning Open

backlog enhancement python

elastic/detection-rules#2496 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 15, 2026
[New Rule] Suspicious Spotlight Importer Open

backlog OS: macOS Rule: New

elastic/detection-rules#2564 · 1 comment · 0 reactions · 1 assignee · Indexed Sep 15, 2026
[New Rule] Mdfind Sensitive File Discovery Open

backlog OS: macOS Rule: New

elastic/detection-rules#2567 · 2 comments · 1 reaction · 1 assignee · Indexed Sep 15, 2026
[New Rule] Suspicious Content Extracted or Decompressed via Built-In Utilities Open

backlog OS: macOS Rule: New

elastic/detection-rules#2569 · 1 comment · 1 reaction · 1 assignee · Indexed Sep 15, 2026
[New Rule] Potential iTerm2 Autolaunch Process Hijack Open

backlog OS: macOS Rule: New

elastic/detection-rules#2573 · 1 comment · 1 reaction · 1 assignee · Indexed Sep 15, 2026
[New Rule] Suspicious Manual VScode Extension Installation Open

backlog OS: macOS Rule: New

elastic/detection-rules#2575 · 1 comment · 1 reaction · 1 assignee · Indexed Sep 15, 2026
Rule loader warnings Open

backlog

elastic/detection-rules#2606 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 15, 2026
`RuleLoader` cleanup and optimizations Open

backlog python

elastic/detection-rules#2609 · 5 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
[New Rule] Suspicious Anonymous Windows Authentication Open

backlog community Rule: New

elastic/detection-rules#2642 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
[New Rule] Google Workspace Suspicious File Type Downloads from Drive Followed by Execution Open

backlog Integration: Google Workspace Rule: New v8.8.0

elastic/detection-rules#2716 · 2 comments · 0 reactions · 1 assignee · Indexed Sep 15, 2026
Add ECS schemas for `kibana.*` and `signal.*` for validation Open

backlog enhancement v8.10 v8.8.0

elastic/detection-rules#2763 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
[FR] Add `source_updated_at` to Rule Schema as a Build Time Field Open

backlog enhancement v8.10

elastic/detection-rules#2826 · 46 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
[FR] Additional Unit Test For Placeholder Fields Open

backlog enhancement python

elastic/detection-rules#2950 · 4 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
[FR] Align "Data Source" tags with MITRE Open

backlog community enhancement

elastic/detection-rules#3290 · 2 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
[FR] Update branch checks workflow resiliency Open

backlog enhancement

elastic/detection-rules#3309 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
[Meta] Adversary Behavior Detections - Midnight Blizzard (APT29) Open

backlog Domain: Cloud Workloads Integration: Azure Meta Team: TRADE

elastic/detection-rules#3412 · 0 comments · 1 reaction · 1 assignee · Indexed Sep 15, 2026
Refactor NON_DATASET_PACKAGE approach to support packages Open

backlog enhancement python Team: TRADE

elastic/detection-rules#3447 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 15, 2026
[Meta] Explore Detection Opportunities on Active Directory Object Ownership and Privilege Assignment Open

backlog Meta OS: Windows Team: TRADE

elastic/detection-rules#3522 · 3 comments · 0 reactions · 1 assignee · Indexed Sep 15, 2026
[Meta] Linux Active Directory Tooling detection Open

backlog Meta OS: Linux Team: TRADE

elastic/detection-rules#3523 · 1 comment · 1 reaction · 1 assignee · Indexed Sep 15, 2026
[Meta] Refactor Rule Loader for Optimizations & Additional Schema Improvements Open

backlog enhancement Meta python Team: TRADE

elastic/detection-rules#3556 · 2 comments · 0 reactions · 1 assignee · Indexed Sep 15, 2026
[Meta] Refactor Rule Create and Importer Logic Open

backlog enhancement Meta python Team: TRADE

elastic/detection-rules#3557 · 2 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
[Meta] Refactor Rule Formatter Open

backlog enhancement Meta python Team: TRADE

elastic/detection-rules#3558 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 15, 2026
[FR] Better Error Messages for Schema Validation Open

backlog enhancement python

elastic/detection-rules#3571 · 2 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
[FR][DAC] Consideration: Add validation on exceptions values Open

backlog detections-as-code enhancement

elastic/detection-rules#3623 · 2 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
[FR][DAC] Consideration: expose a callback function within `kibana export-rules` to organize the output Open

backlog detections-as-code enhancement

elastic/detection-rules#3625 · 2 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
[Meta] Data Exploration for Detections - Microsoft Graph Activity Logs Open

backlog Domain: Cloud Workloads Integration: Azure Meta Team: TRADE

elastic/detection-rules#3645 · 1 comment · 0 reactions · 1 assignee · Indexed Sep 15, 2026
[Rule Tuning] Tampering of Shell Command-Line History Open

backlog Rule: Tuning

elastic/detection-rules#3648 · 1 comment · 0 reactions · 1 assignee · Indexed Sep 15, 2026
[FR][DAC] Consideration: Explore packaging when bypassing the version lock Open

backlog detections-as-code enhancement

elastic/detection-rules#3696 · 2 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
[FR] Revisit Filter Schema for Removal or Extension Open

backlog enhancement python schema

elastic/detection-rules#3773 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
[FR][DAC] Consideration: Add support for exceptions APIs in Kibana module Open

backlog detections-as-code enhancement kibana-module

elastic/detection-rules#3785 · 0 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
[FR][DAC] Consideration: Add CLI commands for deprecate / disable rules Open

backlog detections-as-code enhancement Team: TRADE

elastic/detection-rules#3786 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 15, 2026
[Meta] Tool Detections - EvilNoVNC (Phishing) Open

backlog Domain: Cloud Workloads Meta Team: TRADE

elastic/detection-rules#3787 · 1 comment · 1 reaction · 1 assignee · Indexed Sep 15, 2026
[Meta] Active Directory Certificate Services (AD CS) - Part 1 Open

backlog Domain: Endpoint Meta OS: Windows Team: TRADE

elastic/detection-rules#3865 · 0 comments · 0 reactions · 2 assignees · Indexed Sep 15, 2026

elastic/detection-rules

Get new issues in your inbox