Sandbox::https://github.com/elastic/detection-rules/pulls

Update dependency python to 3.15

#7002elastic-renovate-prod[bot] opened

Oct 10, 2026

Bot1 task

Tunes Svchost spawning Cmd to close two evasion gaps:

#7001abdelghafourbouhdyd opened

Oct 10, 2026

1

[Rule Tuning] Potential Computer Account NTLM Relay Activity

#7000tradebot-elastic opened

Oct 10, 2026

Contributor

[New Rules/Tuning] Windows Atomic credential, discovery and execution coverage

#6999django-88 opened

Oct 9, 2026

Contributor

1

[Rule Tuning] Work around EQL optional-field bug and fix data source compatibility

#6998w0rk3r opened

Oct 9, 2026

Contributor

11

[New Rule] Potential Prompt Injection Coercing Shell Execution

#6997Mikaayenson opened

Oct 9, 2026

Contributor

6

[New Rule] Entra ID Primary Refresh Token Used by a Command-Line Client (ROADtools PRT replay)

#6996terrancedejesus opened

Oct 9, 2026

Contributor

[Rule Tuning] ROADtools Device Registration Detections

#6995terrancedejesus opened

Oct 9, 2026

Contributor

[New Rule] Entra ID Passkey Registration Detections (ROADtools registerpasskey)

#6994terrancedejesus opened

Oct 9, 2026

Contributor

[Rule Tuning] Azure AD Graph Potential Enumeration (ROADrecon)

#6993terrancedejesus opened

Oct 9, 2026

Contributor2 tasks done

2

[Rule Tuning] Multiple Logon Failure from the same Source Address

#6992tradebot-elastic opened

Oct 9, 2026

Contributor

[New Rules] AWS EKS Audit Coverage - Part 5

#6991bryans3c opened

Oct 9, 2026

Contributor

1

[New Rules] AWS EKS Audit Coverage - Part 4

#6990bryans3c opened

Oct 9, 2026

Contributor

1

[New Rules] AWS EKS Audit Coverage - Part 3

#6989bryans3c opened

Oct 9, 2026

Contributor

1

[New Rules] AWS EKS Audit Coverage - Part 2

#6988bryans3c opened

Oct 9, 2026

Contributor

1

[New Rules] AWS EKS Audit Coverage - Part 1

#6987bryans3c opened

Oct 9, 2026

Contributor

1

[New Rules] Detect account and registry deception and extend WER coverage

#6980django-88 opened

Oct 8, 2026

Contributor

1

[New Rules] Detect Windows defense and recovery configuration changes

#6979django-88 opened

Oct 8, 2026

Contributor

1

[New Rules] AWS Identity Center Coverage

#6977bryans3c opened

Oct 8, 2026

Contributor

7

[Rule Tuning] Detect Run-key changes by SYSTEM PowerShell

#6976django-88 opened

Oct 7, 2026

Contributor

3

[Rule Tuning] Detect additional uncommon registry persistence paths

#6973django-88 opened

Oct 7, 2026

Contributor

2

[New Rules] Detonate FNs

#6972Aegrah opened

Oct 7, 2026

Contributor

10

[Rule Tuning] GitHub noise reduction

#6970bryans3c opened

Oct 7, 2026

Contributor

12

Update actions/upload-artifact digest to cf430e0

#6969elastic-renovate-prod[bot] opened

Oct 7, 2026

Bot1 task

[New / Tuning] Entra ID Register Device with Phishing Kit or ROADtools Fingerprint

#6967Samirbous opened

Oct 7, 2026

Contributor

3

Navigation Menu

Repository navigation

All pull requests

Update dependency python to 3.15

Tunes Svchost spawning Cmd to close two evasion gaps:

[Rule Tuning] Potential Computer Account NTLM Relay Activity

[New Rules/Tuning] Windows Atomic credential, discovery and execution coverage

[Rule Tuning] Work around EQL optional-field bug and fix data source compatibility

[New Rule] Potential Prompt Injection Coercing Shell Execution

[New Rule] Entra ID Primary Refresh Token Used by a Command-Line Client (ROADtools PRT replay)

[Rule Tuning] ROADtools Device Registration Detections

[New Rule] Entra ID Passkey Registration Detections (ROADtools registerpasskey)

[Rule Tuning] Azure AD Graph Potential Enumeration (ROADrecon)

[Rule Tuning] Multiple Logon Failure from the same Source Address

[New Rules] AWS EKS Audit Coverage - Part 5

[New Rules] AWS EKS Audit Coverage - Part 4

[New Rules] AWS EKS Audit Coverage - Part 3

[New Rules] AWS EKS Audit Coverage - Part 2

[New Rules] AWS EKS Audit Coverage - Part 1

[New Rules] Detect account and registry deception and extend WER coverage

[New Rules] Detect Windows defense and recovery configuration changes

[New Rules] AWS Identity Center Coverage

[Rule Tuning] Detect Run-key changes by SYSTEM PowerShell

[Rule Tuning] Detect additional uncommon registry persistence paths

[New Rules] Detonate FNs

[Rule Tuning] GitHub noise reduction

Update actions/upload-artifact digest to cf430e0

[New / Tuning] Entra ID Register Device with Phishing Kit or ROADtools Fingerprint

Pull requests