Search results

[Rule Tuning] Suspicious Process Access via Direct System Call

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#5895 In elastic/detection-rules;

· lowlevel01 opened on Mar 28, 2026

[Rule Tuning] Entra ID Illicit Consent Grant via Registered Application - Fix New Terms Field

Domain: Cloud

Domain: Identity

Integration: Azureazure related rulesazure related rules

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Status: Open.

#5893 In elastic/detection-rules;

· terrancedejesus opened on Mar 27, 2026

[Rule Tuning] Suspicious macOS MS Office Child Process

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#5886 In elastic/detection-rules;

· rkarimovs opened on Mar 26, 2026

[Rule Tuning] Kernel Module Load via Built-in Utility (2339f03c-f53f-40fa-834b-40c5983fc41f)

genai-tradecraft

Status: Open.

#5844 In elastic/detection-rules;

· tradebot-elastic opened on Mar 18, 2026

[DAC] [FR] Add Batch Import to DaC CLI

community

enhancementNew feature or requestNew feature or request

Team: TRADE

Status: Open.

#5829 In elastic/detection-rules;

· hhhharshil opened on Mar 12, 2026

[Rule Tuning] Network Traffic Capture via CAP_NET_RAW

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#5826 In elastic/detection-rules;

· jvalente-salemstate opened on Mar 11, 2026

[Rule Tuning] Suspicious Child Execution via Web Server (f16fca20-4d6c-43f9-aec1-20b6de3b0aeb)

genai-tradecraft

Status: Open.

#5815 In elastic/detection-rules;

· tradebot-elastic opened on Mar 9, 2026

[Bug] DAC - Timeline rules that validate fine in Kibana fails validation in DAC

bugSomething isn't workingSomething isn't working

community

Team: TRADE

Status: Open.

#5814 In elastic/detection-rules;

· 0xBAADF0OD opened on Mar 6, 2026

[Rule Tuning] Unusual Instance Metadata Service (IMDS) API Request (ecc0cd54-608e-11ef-ab6d-f661ea17fbce)

genai-tradecraft

Status: Open.

#5801 In elastic/detection-rules;

· tradebot-elastic opened on Mar 1, 2026

[Rule Tuning] Potential Reverse Shell Activity via Terminal (a1a0375f-22c2-48c0-81a4-7c2d11cc6856)

genai-tradecraft

Status: Open.

#5798 In elastic/detection-rules;

· tradebot-elastic opened on Feb 28, 2026

[Rule Tuning] Machine Learning Detected DNS Request Predicted to be a DGA domain

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#5787 In elastic/detection-rules;

· khalavak opened on Feb 26, 2026

[Bug] KQL syntax error w/ Space between wildcard keywords

bugSomething isn't workingSomething isn't working

Team: TRADE

Status: Open.

#5750 In elastic/detection-rules;

· imays11 opened on Feb 20, 2026