Search results

[Rule Tuning] Container filesystem modification detected (4b4e9c99-27ea-4621-95c8-82341bc6e512)

genai-tradecraft

Status: Open.

#5608 In elastic/detection-rules;

· tradebot-elastic opened on Jan 24, 2026

[Rule Tuning] Network Activity to a Suspicious Top Level Domain (e516bf56-d51b-43e8-91ec-9e276331f433)

genai-tradecraft

Status: Open.

#5607 In elastic/detection-rules;

· tradebot-elastic opened on Jan 24, 2026

[Rule Tuning] Accepted Default Telnet Port Connection

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

Enhancement

#5606 In elastic/detection-rules;

· eric-forte-elastic opened on Jan 23, 2026

[Bug] Improper prebuilt rule version usage in security_detection_engine package versions

bugSomething isn't workingSomething isn't working

Status: Open.

Bug

#5601 In elastic/detection-rules;

· maximpn opened on Jan 22, 2026

CLI docs update

Status: Open.

#5599 In elastic/detection-rules;

· approksiu opened on Jan 22, 2026

[Rule Tuning] Entra ID OAuth Authorization Code Grant for Unusual User, App, and Resource

Domain: Cloud

Domain: Identity

Integration: Azureazure related rulesazure related rules

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Status: Open.

#5588 In elastic/detection-rules;

· terrancedejesus opened on Jan 20, 2026

[Rule Tuning] Entra ID OAuth Phishing via First-Party Microsoft Application

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#5584 In elastic/detection-rules;

· rkarimovs opened on Jan 20, 2026

[Rule Tuning] Accepted Default Telnet Port Connection (34fde489-94b0-4500-a76f-b8a157cf9269)

genai-tradecraft

Status: Open.

#5576 In elastic/detection-rules;

· tradebot-elastic opened on Jan 19, 2026

[Rule Tuning] Execution via Windows Subsystem for Linux (db7dbad5-08d2-4d25-b9b1-d3a1e4a15efd)

genai-tradecraft

Status: Open.

#5575 In elastic/detection-rules;

· tradebot-elastic opened on Jan 19, 2026

[Rule Tuning] Unsigned DLL Side-Loading from a Suspicious Folder (58b0d8e5534f62bfc51f8de8ca370dc1b8699e69)

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#5572 In elastic/detection-rules;

· ailiffa opened on Jan 17, 2026

[Hunt Tuning] Fix Invalid ES|QL Syntax in Hunting Queries

Hunt: Tuning

Status: Open.

#5565 In elastic/detection-rules;

· terrancedejesus opened on Jan 16, 2026

[FR] [DAC] Consideration: Safeguards for Kibana Rule Loading Race Conditions

community

detections-as-code

enhancementNew feature or requestNew feature or request

pythonInternal python for the repositoryInternal python for the repository

Team: TRADE

Status: Open.

Enhancement

#5564 In elastic/detection-rules;

· eric-forte-elastic opened on Jan 16, 2026