Skip to content

Pull requests: elastic/detection-rules

New pull request New
78 Open 4,398 Closed
78 Open 4,398 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Reviews
Filter by reviews
No reviews Review required Approved review Changes requested
Assignee
Filter by who’s assigned
Assigned to nobody Loading
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Pull requests list

[Rule Tuning] RPC (Remote Procedure Call) to the Internet backport: auto genai-tradecraft Rule: Tuning tweaking or tuning an existing rule
#6552 opened Aug 1, 2026 by Mikaayenson Contributor Loading…
@eric-forte-elastic
3
Update actions/checkout digest backport: auto community
#6551 opened Jul 31, 2026 by elastic-renovate-prod Bot Loading…
1 task
[Rule Tuning] Rewriting execution through perl rule due to impossible condition backport: auto community Domain: Endpoint OS: Linux
#6549 opened Jul 31, 2026 by litemars Contributor Loading…
[Rule Tuning] Wrong regex in the macOS c2 detection query backport: auto community Domain: Endpoint OS: macOS
#6548 opened Jul 30, 2026 by litemars Contributor Loading…
[Rule Tuning] Adding co-author in multiple rules backport: auto community Domain: Endpoint OS: Linux OS: macOS
#6547 opened Jul 30, 2026 by litemars Contributor Loading…
[New Rule] Certighost ADCS Detections
#6537 opened Jul 30, 2026 by terrancedejesus Contributor • Draft
5 tasks
@terrancedejesus
7
[New Rule] Potential NFS Destructive Operation Burst backport: auto Domain: Network Integration: Network Traffic Rule: New Proposal for new rule
#6536 opened Jul 30, 2026 by eric-forte-elastic Contributor Loading…
5 tasks
@eric-forte-elastic
19
[Bug] Edge case rule loading bugs backport: auto bug Something isn't working patch python Internal python for the repository
#6532 opened Jul 30, 2026 by eric-forte-elastic Contributor Loading…
5 tasks
@eric-forte-elastic
2
[Rule: Tuning] Fixing logic issue on the macOS rule for discovery external IP using curl backport: auto community Domain: Endpoint OS: macOS
#6530 opened Jul 30, 2026 by litemars Contributor Loading…
3
[Rule Tuning] Fixing Typo in the macOS persistence emond modification rule backport: auto community Domain: Endpoint OS: macOS
#6529 opened Jul 30, 2026 by litemars Contributor Loading…
5
[New Rule] Direct Process Execution via setsid, nohup, or disown backport: auto Domain: Endpoint OS: Linux Rule: New Proposal for new rule Team: TRADE
#6526 opened Jul 30, 2026 by Aegrah Contributor Loading…
@Aegrah
10
[Rule Tuning] Suspicious Service was Installed in the System backport: auto Domain: Endpoint OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6523 opened Jul 29, 2026 by w0rk3r Contributor Loading…
@w0rk3r
6
[New Rule] First Time Seen RMM Signer Across the Environment backport: auto Domain: Endpoint OS: Windows windows related rules Rule: New Proposal for new rule
#6522 opened Jul 29, 2026 by w0rk3r Contributor Loading…
@w0rk3r
4
[Rule Tuning] Potential Timestomp in Executable Files backport: auto Domain: Endpoint genai-tradecraft OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6521 opened Jul 29, 2026 by Mikaayenson Contributor Loading…
@w0rk3r
7
[Bug] Fix import-rules error handling: KeyError on errors without rule_id; unread exceptions/connector error arrays community
#6504 opened Jul 27, 2026 by runicdefnd3r • Draft
1 task
1
Validate the field against the schema in KQL range expressions backport: auto community Domain: Endpoint OS: Windows windows related rules
#6502 opened Jul 27, 2026 by munzzyy Loading…
3
Fix KQL to EQL conversion treating an escaped/quoted asterisk as a wildcard backport: auto bug Something isn't working community patch
#6501 opened Jul 27, 2026 by munzzyy Loading…
8
WIP - [FR] Local Python Parsing for ES|QL minor python Internal python for the repository
#6500 opened Jul 26, 2026 by eric-forte-elastic Contributor • Draft
5 tasks
[FR] Offline ES|QL validation via python-esql enhancement New feature or request
#6499 opened Jul 26, 2026 by Mikaayenson Contributor • Draft
3 of 5 tasks
@Mikaayenson
4
[FR] Add Safeguard for Kibana Rule Exception Race Condition backport: auto community detections-as-code enhancement New feature or request patch python Internal python for the repository
#6493 opened Jul 23, 2026 by eric-forte-elastic Contributor Loading…
5 tasks
1
@eric-forte-elastic
4
[FR] Add nested KQL query support in lib/kql backport: auto enhancement New feature or request kql related to the kql module patch python Internal python for the repository Team: TRADE
#6492 opened Jul 23, 2026 by imays11 Contributor Loading…
3 tasks done
1
@imays11
5
[Bug] ECS Checks Overly Broad in Certain Integrations backport: auto bug Something isn't working patch python Internal python for the repository schema
#6491 opened Jul 23, 2026 by eric-forte-elastic Contributor Loading…
5 tasks
@eric-forte-elastic
6
[Rule Tuning] Potential Lateral Tool Transfer via SMB Share backport: auto Domain: Endpoint genai-tradecraft OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6490 opened Jul 23, 2026 by Mikaayenson Contributor Loading…
@w0rk3r
3
[FR] Add free text support to KQL backport: auto enhancement New feature or request kql related to the kql module patch python Internal python for the repository
#6487 opened Jul 22, 2026 by eric-forte-elastic Contributor Loading…
5 tasks
1
@eric-forte-elastic
4
[Rule Tuning] Unusual Discovery Signal Alert with Unusual Process Command Line backport: auto Domain: Endpoint genai-tradecraft OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
#6484 opened Jul 22, 2026 by Mikaayenson Contributor Loading…
@w0rk3r
5
ProTip! What’s not been updated in a month: updated:<2026-07-01.