Search results

[New Rule] Multi-Base64 Decoding Attempt from Suspicious Location

backport: auto

Domain: Endpoint

OS: Linux

Team: TRADE

Status: Open (in progress).

elastic/detection-rulesnumber 4931

#4931 In elastic/detection-rules;

· Aegrah opened on Jul 24, 2025

[New Rule] Unusual Web Config File Access

backport: auto

Domain: Endpoint

OS: Windowswindows related ruleswindows related rules

Rule: NewProposal for new ruleProposal for new rule

Status: Open (in progress).

elastic/detection-rulesnumber 4927

#4927 In elastic/detection-rules;

· w0rk3r opened on Jul 23, 2025

[New Rule/Tuning] Linux User or Group Deletion/Creation

backport: auto

Domain: Endpoint

OS: Linux

Rule: NewProposal for new ruleProposal for new rule

Team: TRADE

Status: Open (in progress).

elastic/detection-rulesnumber 4861

#4861 In elastic/detection-rules;

· Aegrah opened on Jun 30, 2025

[New] Command Line Obfuscation via Whitespace Padding

backport: auto

Domain: Endpoint

OS: Windowswindows related ruleswindows related rules

Rule: NewProposal for new ruleProposal for new rule

Status: Open (in progress).

elastic/detection-rulesnumber 4860

#4860 In elastic/detection-rules;

· Samirbous opened on Jun 30, 2025

[New Rules] Potential Relay Attack against a Computer Account

backport: auto

Domain: Endpoint

OS: Windowswindows related ruleswindows related rules

Rule: NewProposal for new ruleProposal for new rule

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Status: Open (in progress).

elastic/detection-rulesnumber 4826

#4826 In elastic/detection-rules;

· w0rk3r opened on Jun 18, 2025

[Security Content] Windows Audit Policies Config Guides - Repo Edition

backlog

backport: auto

Domain: Endpoint

OS: Windowswindows related ruleswindows related rules

Security Content

Status: Open (in progress).

elastic/detection-rulesnumber 4501

#4501 In elastic/detection-rules;

· w0rk3r opened on Feb 26, 2025

[Security Content] Basic EDR Setup Guides - Phase 1

backlog

backport: auto

Domain: Endpoint

OS: Windowswindows related ruleswindows related rules

Security Content

Status: Draft (not ready).

elastic/detection-rulesnumber 4492

#4492 In elastic/detection-rules;

· w0rk3r opened on Feb 24, 2025

[New Rule] Active Directory Forced Authentication from Linux Host

backlog

backport: auto

Domain: Endpoint

OS: Windowswindows related ruleswindows related rules

Rule: NewProposal for new ruleProposal for new rule

Status: Draft (not ready).

elastic/detection-rulesnumber 3912

#3912 In elastic/detection-rules;

· w0rk3r opened on Jul 22, 2024

[Meta] Active Directory Certificate Services (AD CS) - Part 1

backlog

Domain: Endpoint

Meta

OS: Windowswindows related ruleswindows related rules

Team: TRADE

Status: Open.

#3865 In elastic/detection-rules;

· w0rk3r opened on Jul 3, 2024

[New Rule] Elastic Agent status not validated

backlog

Domain: Endpoint

esqlES|QLES|QL

OS: Linux

OS: macOS

OS: Windowswindows related ruleswindows related rules

Rule: NewProposal for new ruleProposal for new rule

Status: Open.

#3719 In elastic/detection-rules;

· peasead opened on May 29, 2024