Issues · elastic/detection-rules · GitHub

Labels Milestones New issue

New Rules: 15 Google Workspace detection gaps (identity, exfiltration, impact)

#6122

· saakovv opened

on May 10, 2026

[New] 15 GCP detection rules covering IAM, KMS, org policy, and data exfiltration gaps

#6120

· saakovv opened

on May 10, 2026

[New] 15 AWS CloudTrail detection rules covering IAM, EC2, and org-level security gaps

#6118

· saakovv opened

on May 10, 2026

[Rule Tuning] File Creation in World-Writable Directory by Unusual Process (1f56f548-94ec-4678-b1ed-b1a14cca4e3a)

genai-tradecraft

#6097

· tradebot-elastic opened

on May 7, 2026

[DaC] additional line break added to query after export/import

detections-as-code

#6081

· wingiti opened

on May 5, 2026

[FR] Migrate rules from retired Defense Evasion tactic (Stealth TA0005 / Defense Impairment TA0112)

#6035

· shashank-elastic opened

on May 4, 2026

[FR] Update Network Rules With Zeek Support

#6029

· eric-forte-elastic opened

on May 2, 2026

[FR] Remove Endgame support after EOL

#6021

· Mikaayenson opened

on May 1, 2026

[Rule Tuning] First-Time FortiGate Administrator Login

#6020

· JoeySec opened

on Apr 30, 2026

[Rule Tuning] Privileges Elevation via Parent Process PID Spoofing (26b01043-4f04-4d2f-882a-5a1d2e95751b)

genai-tradecraft

#6016

· tradebot-elastic opened

on Apr 30, 2026

[Rule Tuning] Linux Restricted Shell Breakout via Linux Binary(s) (52376a86-ee86-4967-97ae-1a05f55816f0)

genai-tradecraft

#5983

· tradebot-elastic opened

on Apr 25, 2026

[Rule Tuning] Suspicious macOS MS Office Child Process

#5886

· rkarimovs opened

on Mar 26, 2026