Search results

[Rule Tuning] Suspicious Microsoft 365 UserLoggedIn via OAuth Code

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#4838 In elastic/detection-rules;

· eriroley opened on Jun 19, 2025

[Tuning] Elevation via SCM rules

backport: auto

Domain: Endpoint

OS: Windowswindows related ruleswindows related rules

patch

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Status: Open (in progress).

elastic/detection-rulesnumber 4837

#4837 In elastic/detection-rules;

· Samirbous opened on Jun 19, 2025

[Rule Tuning] Added Kubernetes Domain Tag

backport: auto

container

Domain: Endpoint

OS: Linux

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open (in progress).

elastic/detection-rulesnumber 4831

#4831 In elastic/detection-rules;

· Aegrah opened on Jun 19, 2025

[Rule Tuning] AWS SSM SendCommand Execution by Rare User

backport: auto

Domain: Cloud

Integration: AWSAWS related rulesAWS related rules

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open (in progress).

elastic/detection-rulesnumber 4828

#4828 In elastic/detection-rules;

· imays11 opened on Jun 19, 2025

[Rule Tunings] AWS Role Assumption By Service / User

backport: auto

Domain: Cloud

Integration: AWSAWS related rulesAWS related rules

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open (in progress).

elastic/detection-rulesnumber 4827

#4827 In elastic/detection-rules;

· imays11 opened on Jun 19, 2025

[New Rules] Potential Relay Attack against a Computer Account

backport: auto

Domain: Endpoint

OS: Windowswindows related ruleswindows related rules

Rule: NewProposal for new ruleProposal for new rule

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Status: Open (in progress).

elastic/detection-rulesnumber 4826

#4826 In elastic/detection-rules;

· w0rk3r opened on Jun 18, 2025

[Rule Tuning] Sharpening Kubernetes Rules Indices

backport: auto

container

OS: Linux

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open (in progress).

elastic/detection-rulesnumber 4822

#4822 In elastic/detection-rules;

· Aegrah opened on Jun 18, 2025

[Rule Tuning] Suspicious Microsoft 365 Mail Access by ClientAppId

Domain: Cloud

Domain: Email

Integration: Microsoft 365

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

Task

#4807 In elastic/detection-rules;

· terrancedejesus opened on Jun 16, 2025

[Rule Tuning] Suspicious Microsoft 365 Mail Access by Unusual ClientAppId

backport: auto

Domain: Cloud

Domain: Email

Integration: Microsoft 365

patch

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Status: Open (in progress).

elastic/detection-rulesnumber 4806

#4806 In elastic/detection-rules;

· terrancedejesus opened on Jun 16, 2025

[Rule Tuning] Svchost spawning Cmd

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#4789 In elastic/detection-rules;

· richlv opened on Jun 11, 2025

[Rule Tuning] ES|QL Lookback Window and Execution Interval Adjustments

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

Task

#4773 In elastic/detection-rules;

· terrancedejesus opened on Jun 4, 2025

[Rule Tuning] Unusual File Creation - Alternate Data Stream - WinMerge

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#4764 In elastic/detection-rules;

· richlv opened on Jun 3, 2025

[Meta] Evaluate Metadata for Linux Ruleset

Meta

OS: Linux

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#4754 In elastic/detection-rules;

· Aegrah opened on May 30, 2025

[Rule Tuning] Suspicious Endpoint Security Parent Process - Wrong or missing SecurityHealthHost path

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#4746 In elastic/detection-rules;

· willemdh opened on May 25, 2025

[Security Solution] "Modification of Safari Settings via Defaults Command" rule seems to be broken after update

bugSomething isn't workingSomething isn't working

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#4741 In elastic/detection-rules;

· saernz opened on May 21, 2025

[Rule Tuning] Windows Registry File Creation in SMB Share

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#4722 In elastic/detection-rules;

· tschaegge-b opened on May 14, 2025

[Rule Tuning] attrib.exe usage by draw.io

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#4721 In elastic/detection-rules;

· richlv opened on May 13, 2025

[Rule Tuning] Suspicious Access to LDAP Attributes - Ignored Fields

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#4698 In elastic/detection-rules;

· w0rk3r opened on May 5, 2025

[Rule Tuning] Potential Ransomware Behavior - High count of Readme files by System

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#4653 In elastic/detection-rules;

· w0rk3r opened on Apr 24, 2025

[Rule Tuning] Google Workspace Admin Role Assigned to a User

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#4651 In elastic/detection-rules;

· buzzdeee opened on Apr 24, 2025

[Rule Tuning] Suspicious Execution from a Mounted Device

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#4603 In elastic/detection-rules;

· kenza-ab opened on Apr 10, 2025

[Rule Tuning] RPC (Remote Procedure Call) from the Internet

backlog

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#4268 In elastic/detection-rules;

· SebastianHuettersen opened on Nov 13, 2024

[Rule Tuning] External User Added to Google Workspace Group

backlog

Integration: Google Workspace

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#4128 In elastic/detection-rules;

· brokensound77 opened on Oct 2, 2024

[Rule Tuning] Google Workspace Drive Encryption Key(s) Accessed from Anonymous User

backlog

Integration: Google Workspace

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#4120 In elastic/detection-rules;

· brokensound77 opened on Oct 2, 2024

[Rule Tuning] Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy

backlog

Integration: Oktaokta related rulesokta related rules

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#4119 In elastic/detection-rules;

· brokensound77 opened on Oct 2, 2024