Detection Rules

No entries match these filters. Clear filters

1. dev-v3.0.0 Sep 25, 2026 · issue 086

   dev-v3.0.0 ships offline ES|QLES|QLElasticsearch Query Language, maintained by Elastic, a pipe-based query language for filtering, transforming, and aggregating data stored in Elasticsearch, giving cyber tools a concise syntax for log and event analysis. validation, XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss./SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. taxonomy tags, ES|QL sub-query support, and a wave of new detection rules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch dev-v3.0.0 https://github.com/elastic/detection-rules.git
   # already have the repo? check out this version:
   $ git checkout dev-v3.0.0

   • Replaces remote ES|QL validation with offline validation via detection-rules-esql-py 0.1.0, checking rules at load time against min_stack_version and local schemas; DR_BYPASS_ESQL_KEEP_VALIDATION and DR_BYPASS_ESQL_METADATA_VALIDATION still skip only the KEEP and FROM metadata checks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Removes the --esql-remote-validation flag; queries no longer need to be posted to an Elasticsearch cluster for validation.
   • Adds XDR/SIEM taxonomy tags (phase 1) to rules.
   • Adds rule profiling tags: Recommended, Noise, Performance, Threat.
   • Supports ES|QL sub queries in rule validation.

   +17 more show less

   • Adds new detection rule: Potential ClickFix Command via Windows Run Dialog.
   • Adds new detection rule: Linux Firewall Rule Creation or Modification.
   • Adds new detection rule: Potential Fileless Execution via Unusual memfd Create Call.
   • Adds new detection rule: Potential Fileless Execution via O_TMPFILE.
   • Adds new detection rules: Three Linux File-Related Web Server Rules.
   • Adds new detection rule: Azure AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations. Pod Exec Potential Reverse Shell.
   • Adds new detection rule: Newly Seen Commonly Abused Network Scanner.
   • Adds new detection rules: RMM Installation via Internet-Originated MSI.
   • Adds new detection rule: First Seen Network Flow Exporter.
   • Adds new detection rule: Azure WireServer Abuse Related Detections.
   • Adds new detection rule: Potential Data Exfiltration via AzCopy or Azure Storage Explorer.
   • Adds new detection rule: Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. Windows HelloWindows HelloA Microsoft authentication framework built into Windows 10 and later that lets users sign in via biometrics or PIN instead of passwords, giving cyber tools a phishing-resistant credential layer to build on. for Business Key-Borrowing Detections.
   • Adds new detection rule: Entra ID device-bound PRT cookie replay from unusual IP.
   • Adds new detection rule: AWS SESAWS SESAmazon's cloud email-sending service, used by tools that need to deliver alerts, reports, or notifications without running their own mail infrastructure. Account Email Sending Enabled.
   • Adds new hunting query: Java_Ghost Threat Actor Infrastructure and Identity Markers.
   • Adds SSH brute force detection rules for the macOS Security Events integration.
   • Adds Anthropic compliance audit detection rules.
   • Replaces remote ES|QL validation with offline validation via detection-rules-esql-py 0.1.0, checking rules at load time against min_stack_version and local schemas; DR_BYPASS_ESQL_KEEP_VALIDATION and DR_BYPASS_ESQL_METADATA_VALIDATION still skip only the KEEP and FROM metadata checks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds XDR/SIEM taxonomy tags (phase 1) to rules.
   • Adds rule profiling tags: Recommended, Noise, Performance, Threat.
   • Supports ES|QL sub queries in rule validation.
   • Adds new detection rule: Potential ClickFix Command via Windows Run Dialog.

   +16 more show less

   • Adds new detection rule: Linux Firewall Rule Creation or Modification.
   • Adds new detection rule: Potential Fileless Execution via Unusual memfd Create Call.
   • Adds new detection rule: Potential Fileless Execution via O_TMPFILE.
   • Adds new detection rules: Three Linux File-Related Web Server Rules.
   • Adds new detection rule: Azure AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations. Pod Exec Potential Reverse Shell.
   • Adds new detection rule: Newly Seen Commonly Abused Network Scanner.
   • Adds new detection rules: RMM Installation via Internet-Originated MSI.
   • Adds new detection rule: First Seen Network Flow Exporter.
   • Adds new detection rule: Azure WireServer Abuse Related Detections.
   • Adds new detection rule: Potential Data Exfiltration via AzCopy or Azure Storage Explorer.
   • Adds new detection rule: Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. Windows HelloWindows HelloA Microsoft authentication framework built into Windows 10 and later that lets users sign in via biometrics or PIN instead of passwords, giving cyber tools a phishing-resistant credential layer to build on. for Business Key-Borrowing Detections.
   • Adds new detection rule: Entra ID device-bound PRT cookie replay from unusual IP.
   • Adds new detection rule: AWS SESAWS SESAmazon's cloud email-sending service, used by tools that need to deliver alerts, reports, or notifications without running their own mail infrastructure. Account Email Sending Enabled.
   • Adds new hunting query: Java_Ghost Threat Actor Infrastructure and Identity Markers.
   • Adds SSH brute force detection rules for the macOS Security Events integration.
   • Adds Anthropic compliance audit detection rules.

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The --esql-remote-validation flag is removed; any workflow or script that passed it will now fail. ES|QL rules are validated offline at load time against local schemas and min_stack_version, and queries that previously loaded only because remote validation was skipped can now fail local syntax, schema, or type checks.
2. dev-v2.2.0 Sep 8, 2026 · issue 069

   dev-v2.2.0 adds 30+ new detection rules spanning AWS, GCP, Linux, macOS, Windows, Kubernetes, and network threats.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch dev-v2.2.0 https://github.com/elastic/detection-rules.git
   # already have the repo? check out this version:
   $ git checkout dev-v2.2.0

   • Adds free text support to KQLKQLKusto Query Language, Microsoft's read-only query language for Azure Data Explorer and Microsoft Sentinel, used by cyber tools to filter, aggregate, and correlate large volumes of log and telemetry data quickly. for detection rule queries.
   • Adds new rule: AWS Root Console Login Password Spraying.
   • Adds new rule: AWS S3 Bucket MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. Delete Disabled.
   • Adds new rule: AWS Organizations Delegated Administrator Registered.
   • Adds new rule: AWS Service Quota Increase Requested by Rare Identity.

   +26 more show less

   • Adds new rule: AWS Backup Resource Enumeration via Long-Term Access Key.
   • Adds new rule: AWS SESAWS SESAmazon's cloud email-sending service, used by tools that need to deliver alerts, reports, or notifications without running their own mail infrastructure. Enumeration via Long-Term Access Key.
   • Adds new rule: AWS SES Identity Verified Then Deleted.
   • Adds new rule: AWS SES Full Access Policy Attached to IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Entity by Unusual User.
   • Adds new rule: AWS Bedrock AgentCore Resource Created with IAM Execution Role.
   • Adds new rule: AWS GetFederationToken Followed by Console Login via Federation Exchange.
   • Adds new rule: AWS GuardDuty Threat Intelligence Set Deleted.
   • Adds new rule: AWS GuardDuty Publishing Destination Deleted.
   • Adds new rule: AWS EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. Access Entry Created Then Deleted by Same Identity.
   • Adds new rule: AWS Detective Graph Deleted.
   • Adds new rule: GCP IAM Service Account Impersonation Role Granted.
   • Adds new rule: Potential Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. PRT Extraction via BrowserCore.
   • Adds new rule: Potential DNS Tunneling via Long and Unique Subdomains.
   • Adds new rule: Potential DNS Rebinding from Public to Private Address.
   • Adds new rule: Self-Signed TLS Certificate Recently Issued on External Connection.
   • Adds new rule: First Seen SonicWall Remote Access Login by User and Source.
   • Adds new rule: Suspicious Process Execution by Zoom on macOS or Linux.
   • Adds new rule: File Downloaded by Curl/Wget and Piped to Interpreter.
   • Adds new rule: Process Execution Followed by Self-Deletion.
   • Adds new rule: Kernel Module Loaded with Tainting Flags.
   • Adds new rule: PKINITPKINITA Kerberos extension that lets a client authenticate using a public-key certificate instead of a password, enabling smart-card and certificate-based login to Active Directory and other Kerberos realms. Followed by Same-Principal U2U Service Ticket.
   • Adds new rule: Potential CertiGhost AD CS Machine Identity Mismatch.
   • Adds new rule: Procfs Syscall Read and binfmt Configuration File Creation.
   • Adds new rule: Claude Cowork VM Boot Image Tamper.
   • Adds new rule: Potential Evasion via Boot Time Removal Tool.
   • Adds new hunting query: AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations. Kubelet nodes/proxy Command Execution from an External Source IP.
   • Adds new rule: AWS Root Console Login Password Spraying.
   • Adds new rule: AWS S3 Bucket MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. Delete Disabled.
   • Adds new rule: AWS Organizations Delegated Administrator Registered.
   • Adds new rule: AWS Service Quota Increase Requested by Rare Identity.
   • Adds new rule: AWS Backup Resource Enumeration via Long-Term Access Key.

   +25 more show less

   • Adds new rule: AWS SESAWS SESAmazon's cloud email-sending service, used by tools that need to deliver alerts, reports, or notifications without running their own mail infrastructure. Enumeration via Long-Term Access Key.
   • Adds new rule: AWS SES Identity Verified Then Deleted.
   • Adds new rule: AWS SES Full Access Policy Attached to IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Entity by Unusual User.
   • Adds new rule: AWS Bedrock AgentCore Resource Created with IAM Execution Role.
   • Adds new rule: AWS GetFederationToken Followed by Console Login via Federation Exchange.
   • Adds new rule: AWS GuardDuty Threat Intelligence Set Deleted.
   • Adds new rule: AWS GuardDuty Publishing Destination Deleted.
   • Adds new rule: AWS EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. Access Entry Created Then Deleted by Same Identity.
   • Adds new rule: AWS Detective Graph Deleted.
   • Adds new rule: GCP IAM Service Account Impersonation Role Granted.
   • Adds new rule: Potential Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. PRT Extraction via BrowserCore.
   • Adds new rule: Potential DNS Tunneling via Long and Unique Subdomains.
   • Adds new rule: Potential DNS Rebinding from Public to Private Address.
   • Adds new rule: Self-Signed TLS Certificate Recently Issued on External Connection.
   • Adds new rule: First Seen SonicWall Remote Access Login by User and Source.
   • Adds new rule: Suspicious Process Execution by Zoom on macOS or Linux.
   • Adds new rule: File Downloaded by Curl/Wget and Piped to Interpreter.
   • Adds new rule: Process Execution Followed by Self-Deletion.
   • Adds new rule: Kernel Module Loaded with Tainting Flags.
   • Adds new rule: PKINITPKINITA Kerberos extension that lets a client authenticate using a public-key certificate instead of a password, enabling smart-card and certificate-based login to Active Directory and other Kerberos realms. Followed by Same-Principal U2U Service Ticket.
   • Adds new rule: Potential CertiGhost AD CS Machine Identity Mismatch.
   • Adds new rule: Procfs Syscall Read and binfmt Configuration File Creation.
   • Adds new rule: Claude Cowork VM Boot Image Tamper.
   • Adds new rule: Potential Evasion via Boot Time Removal Tool.
   • Adds new hunting query: AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations. Kubelet nodes/proxy Command Execution from an External Source IP.

   1 more in Everything

3. dev-v2.1.0 Aug 10, 2026 · issue 042

   dev-v2.1.0 adds 40+ new detection rules across AWS, Azure AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations., GCP GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure., NFS, SIPSIPSession Initiation Protocol, an IETF signaling standard for setting up and tearing down real-time voice and video calls over IP networks, giving cyber tools a structured way to intercept, fuzz, or analyze VoIP traffic., AMQP, and database protocols, plus nested KQLKQLKusto Query Language, Microsoft's read-only query language for Azure Data Explorer and Microsoft Sentinel, used by cyber tools to filter, aggregate, and correlate large volumes of log and telemetry data quickly. query support.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch dev-v2.1.0 https://github.com/elastic/detection-rules.git
   # already have the repo? check out this version:
   $ git checkout dev-v2.1.0

   • Adds nested KQL query support in lib/kql for more expressive rule authoring.
   • New rule: Newly Observed RC4 Kerberos Service Ticket Request — detects unusual RC4 KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. ticket requests in the environment.
   • New rule: Repeated Stalled TLS Handshakes via ALPN acme-tls/1 Extension — surfaces potential abuse of the ACMEACMEAn IETF-standard protocol (RFC 8555) for automating TLS certificate issuance and renewal, letting cyber tools manage certificates without manual CA interaction. TLS-ALPN challenge protocol.
   • New rule: First Time Seen RMM Signer Across the Environment — identifies first-observed remote monitoring and management tool signers.
   • New rule: Azure AKS Service Account Token Created via TokenRequest API — detects token creation abuse in AKS.

   +36 more show less

   • New rule: Potential NFS Destructive Operation Burst — flags mass destructive NFS operations.
   • New rule: Azure AKS Certificate Signing Request Created or Approved — monitors CSRCSRA Certificate Signing Request is a block of encoded data submitted to a certificate authority, containing a public key and identity details, so the CA can issue a signed TLS certificate without ever seeing the private key. activity in AKS clusters.
   • New rule: Potential EDR-Freeze via WerFaultSecure Abuse — detects attempts to freeze EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. processes using WerFaultSecure.
   • New rule: Suspicious UID Change to Root via Python — catches privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. to root through Python.
   • New rule: Direct Process Execution via setsid, nohup, or disown — detects process detachment techniques used to evade monitoring.
   • New rule: Azure AKS CoreDNS or Kube-DNS Configuration Modified — alerts on DNS config tampering in AKS.
   • New rule: Azure AKS Secret get or list with Suspicious User Agent — detects credential harvesting attempts via unusual user agents in AKS.
   • New rule: NFS AUTH_SYS Root UID Access — identifies NFS access using root UID via the AUTH_SYS authentication flavor.
   • New rule: Mark-of-the-Web Removal by an Unusual Process — detects MOTW bypass attempts by unexpected processes.
   • New rules: GCP GKE Rule Conversions Part 3, 4, 5, 6 and GCP GKE CSR Abuse Rules — expands GKE detection coverage across multiple rule sets.
   • New rule: First Time Seen Memcached Writer — identifies first-observed write activity to Memcached instances.
   • New rule: Destructive MongoDB Command — detects potentially destructive operations against MongoDB.
   • New rule: MySQL User-Defined Function Injection — flags UDF injection attacks against MySQL.
   • New rule: Postgresql COPY PROGRAM Command Execution — detects OS command execution via PostgreSQL COPY PROGRAM.
   • New rule: Cassandra JavaScript UDF Creation — surfaces creation of JavaScript user-defined functions in Cassandra.
   • New rule: Thrift RPC Method from an External Client — detects external Thrift RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. calls that may indicate lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. or data access.
   • New rule: Potential SIP REGISTER Brute Force — identifies brute-force attempts against SIP REGISTER endpoints.
   • New rule: Potential SIP Extension Enumeration — detects SIP extension scanning activity.
   • New rule: Successful AMQP Multi-Queue Purge Burst — flags bulk queue purge operations over AMQP.
   • New rule: Multiple SonicWall Login Failures Followed by Successful Login — detects credential stuffing or brute-force success against SonicWall devices.
   • New rule: AWS Bedrock High Risk Filesystem or Execution Tool Invocation — detects dangerous tool usetool useA model's ability to answer with a structured request to run a named function or API, which the application executes and returns. It is how agents take actions. within AWS Bedrock agent sessions.
   • New rule: AWS Batch Job Submitted with Container Override by Unusual Identity — flags container override abuse in AWS Batch.
   • New rule: AWS IAM Permission Boundary or Guardrail Policy Deleted by Unusual Identity — detects privilege escalation via guardrail removal in AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege..
   • New rule: AWS IAM User Created Own Access Key — identifies self-issued access key creation as a persistence technique.
   • New rule: AWS SageMaker Execution Role Passed by Unusual Principal — detects suspicious role-passing in SageMaker.
   • New rule: AWS S3 Bucket ACL Modified to Allow Public Access by New Identity — alerts on public exposure of S3 buckets by previously unseen identities.
   • New rule: AWS EC2 NACL Entry Created or Replaced Allowing All Traffic by New Identity — detects network ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. misconfigurations introduced by new identities.
   • New rule: Unusual File Creation via Web Server — surfaces unexpected file writes originating from web server processes.
   • New rule: Azure AKS Kubernetes Events Deleted — detects log-tampering via event deletion in AKS.
   • New rule: Azure AKS Potential API Enumeration by User — identifies reconnaissance activity against the AKS API server.
   • New rule: Potential Tunneling via Tailscaled — detects potential covert tunneling using the Tailscale daemon.
   • New rule: Azure AKS Suspicious Self-Subject Review via Service Account — flags self-subject access review abuse in AKS.
   • New rule: Azure AKS Ephemeral Container Added to Pod — detects ephemeral container injection into running pods.
   • New rule: Azure AKS User Exec into Pod — alerts on interactive exec sessions into AKS pods.
   • New rule: PHP File Creation in WordPress Plugin Directory — detects webshell placement or supply-chain abuse via plugin directory writes.
   • Adds XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. rule tag taxonomy to Copilot PR review workflow, improving automated rule classification.

   41 details in Everything

4. dev-v2.0.0 Jul 20, 2026 · issue 024

   Elastic Detection Rules dev-v2.0.0 adds MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. v19 support and 80+ new rules across AWS, Azure, Linux, GCP, and network protocols.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch dev-v2.0.0 https://github.com/elastic/detection-rules.git
   # already have the repo? check out this version:
   $ git checkout dev-v2.0.0

   • Adds MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. v19 threat mapping support, automatically applied on Elastic Stack >= 9.5 with dynamic tag assignment.
   • New AWS rules: CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. management event disabling, GuardDuty suppression detection, IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. console login without MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone., IAM user login from multiple geolocations, account closure, org-leave attempts, Cognito unauthenticated identity pool credential issuance, Bedrock AgentCore execution role misuse, Bedrock prompt/completion credential detection, ECRECRAmazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure. public access grants, SageMaker suspicious lifecycle config, Lambda cross-account invocation, Lambda high-frequency invocation, Lambda event source mapping creation, Lambda layer external sharing, Lambda function URL public access, Lambda deletion, Lambda policy cross-account update, Backup vault deletion/lock removal, Backup recovery point deletion, KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. imported key material deletion, IAM inline policy added to group, IAM permissions boundary modification, IAM login profile creation/modification, and IAM account password policy deletion.
   • New Azure/Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. rules: AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations. API server proxying requests to Kubelet, ROPC authentication with unknown client ID, VM extension installation and suspicious child process via CustomScript, VM configuration modification, VM Managed Run Command with unusual principal, VM Extension CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. from unusual ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses., VM Boot Diagnostics retrieval, Serial Console connect with unusual user/ASN, Azure AD Graph access with unusual user/ASN, unusual client/user, suspicious user-agent, and 4xx error surge, Azure AD Graph potential enumeration via ROADrecon, Entra ID AiTM phishing-kit chain, device registration with phishing-kit default OS build, conditional access MFA bypass via Microsoft GraphMicrosoft GraphMicrosoft's unified REST API for accessing data and services across Microsoft 365, Azure AD, and related cloud products, giving cyber tools a single authenticated endpoint to query users, emails, files, and sign-in logs., multiple device registrations by single user, impossible travel sign-in, ROPC auth/legacy client detection, OAuth device code sign-in to Azure AD Graph enumeration, OAuth device code phishing, TAP creation, guest-to-member promotion, and OAuth redirect URI abuse.
   • New GCP/GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. rules: GKE Kubernetes rule conversions (parts 1 and 2) adding coverage for GKE API and workload activity.
   • New Linux rules: kernel core_pattern container escape, systemd service override config file creation, Redis CONFIG SET SSH authorized key injection, potential Redis Lua activity, AMSI bypass via RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. NdrClientCall hook (PowerShell 4104), Linux LPE rule migrations from Endpoint Rules to Detection Rules (parts 1 and 2).

   +6 more show less

   • New network protocol detection rules: ICMP tunneling to the internet, ICMP timestamp/information request from the internet, ICMP redirect from internal host, deprecated TLS version or weak cipher negotiated externally, DHCP starvation via high client MAC cardinality, multiple DHCP servers responding to the same transaction, potential SSH reverse port forwarding, DNS tunneling via nslookup, SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. activity from the internet, and protected storage service access via SMB.
   • New web/application rules: PHP file creation in WordPress plugin directory, potential SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. against Microsoft SQL Server, web server cloud metadata SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. request, and Java dropped-and-executed with DNS lookup.
   • New Windows/endpoint rules: GenAI CLI started with unsafe permission bypass, Quick Assist full control sharing mode enabled, MS Teams rogue help desk detection, and Splunk Enterprise PostgreSQL Sidecar pre-auth RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. detection.
   • New Google Workspace rules: impossible travel login detection.
   • New M365 rules: unusual device code granting detection and Microsoft Defender XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. promotion rules.
   • Related integrations version constraints updated from ^ (caret/compatible) to >= (greater-or-equal) in emitted rule output.

   11 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Emitted related integrations now use >= instead of ^ for version constraints, which is expected to not function on Elastic stacks older than 9.5 — ensure your stack schema map and/or packages.yml match your stack version before upgrading.
   • !MITRE ATT&CK v19 mappings are automatically applied on stack >= 9.5; to use v19 on stacks <= 9.4 you must explicitly set DR_THREAT_MAPPING_FRAMEWORK="MITRE ATT&CK" and DR_THREAT_MAPPING_VERSION=1, or add threat_mapping_framework: "MITRE ATT&CK" and threat_mapping_version: "19" to your _config.yaml.
5. dev-v1.6.0 Mar 10, 2026 · release notes

   New detection rules for Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. federation abuse, SharePoint policy weakening, M365 search access, and kernel discovery via bpftool.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch dev-v1.6.0 https://github.com/elastic/detection-rules.git
   # already have the repo? check out this version:
   $ git checkout dev-v1.6.0

   • Entra ID Domain Federation Abuse rule added
   • M365 SharePoint Site Sharing Policy Weakened rule added
   • Microsoft 365 SharePoint/OneDrive Sensitive Search and File Access rule added
   • Kernel Discovery & BPF Load/Tampering via bpftool rules added
   • ESQL LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-Based Alert Triage Rules introduced

   +10 more show less

   • Execution via OpenClaw Agent detection rule added
   • Potential Persistence via Mandatory User Profile detection added
   • AWS GuardDuty Member Account Manipulation detection added
   • AWS SSMAWS SSMAWS Systems Manager, an Amazon service that lets operators manage EC2 instances and on-premises servers without opening inbound ports, replacing SSH with API-driven session and command execution. Inventory Reconnaissance by Rare User detection added
   • AWS Sensitive IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Operations Performed via CloudShell detection added
   • AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. new identity federation provider rules added
   • AWS EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. Serial Console Access Enabled detection added
   • Okta AiTM Session Cookie Replay Detection rule added
   • Okta Admin Console Login Failure rule added
   • ConsentFix Detections added

   15 details in Everything

6. dev-v1.5.0 Mar 10, 2026 · release notes

   dev-v1.5.0 adds ESQL query validation, SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. package category, and numerous new detection rules for cloud and Windows threats.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch dev-v1.5.0 https://github.com/elastic/detection-rules.git
   # already have the repo? check out this version:
   $ git checkout dev-v1.5.0

   • feat: ESQL query validation against Elastic cluster allows validating ESL queries against a running cluster before deployment
   • Adds SIEM to the package category mapping for better organization of SIEM-related rules
   • New detection rule: Credential Access via TruffleHog Execution
   • New detection rule: GitHub Authentication Token Access via Node.js
   • New detection rule: Azure Storage Account Keys Accessed by Privileged User

   +10 more show less

   • New detection rule: Node.js Pre or Post-Install Script Execution
   • New detection rule: Potential Command Shell via NetCat
   • New detection rule: Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. Actor Token User Impersonation Abuse
   • New detection rule: Azure Storage Account Blob Public Access Enabled
   • New detection rule: Azure RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. Built-In Administrator Roles Assigned
   • New detection rule: Attempt to Clear Logs via Journalctl
   • New detection rule: Potential Ransomware Behavior - High count of Readme files by System
   • New detection rule: Suspicious SeIncreaseBasePriorityPrivilege Use
   • New detection rule: Microsoft Entra ID Protection Alert and Device Registration
   • New detection rule: Curl or Wget Spawned via Node.js

   15 details in Everything

7. dev-v1.4.0 Sep 10, 2025 · release notes

   dev-v1.4.0 adds multi-dataset sequence validation support and negate DOES NOT MATCH to IM rules.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch dev-v1.4.0 https://github.com/elastic/detection-rules.git
   # already have the repo? check out this version:
   $ git checkout dev-v1.4.0

   • Support for multi-dataset sequence validation in schema validation logic.
   • Adds negate DOES NOT MATCH capability to the IM rule type (requires version >=9.2).
   • Adds support for up to 5 group_by fields in threshold rules (requires version >=9.2).

   3 details in Everything

8. dev-v1.3.0 Jul 1, 2025 · release notes

   Adds Kibana rule export filtering, check-version-lock dev CLI subcommand, and over 60 new detection rules.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch dev-v1.3.0 https://github.com/elastic/detection-rules.git
   # already have the repo? check out this version:
   $ git checkout dev-v1.3.0

   • Add Ability to Filter Rule Exports from Kibana
   • Add check-version-lock dev command
   • Lock release versions for 8.14 through 9.0

   3 details in Everything

9. dev-v1.2.0 May 2, 2025 · release notes

   New detection rules for M365 OAuth abuse, AWS S3 and IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. activity, and MSFT Tenant phishing.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch dev-v1.2.0 https://github.com/elastic/detection-rules.git
   # already have the repo? check out this version:
   $ git checkout dev-v1.2.0

   • Microsoft 365 OAuth Redirect to Device Registration rule added
   • Microsoft Entra ID Protection Anonymized IP Risk Detection rule added
   • MSFT Tenant OAuth Phishing via First-Party VSCode Client rule added
   • AWS S3 Static Site JavaScript File Uploaded rule added
   • AWS IAM or STS API Calls via Temporary Session Tokens rule added

   5 details in Everything

10. dev-v1.1.0 Apr 24, 2025 · release notes

    Adds CLI flags for KQLKQLKusto Query Language, Microsoft's read-only query language for Azure Data Explorer and Microsoft Sentinel, used by cyber tools to filter, aggregate, and correlate large volumes of log and telemetry data quickly.-based rule export and local date support to the Detection Rules tool.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch dev-v1.1.0 https://github.com/elastic/detection-rules.git
    # already have the repo? check out this version:
    $ git checkout dev-v1.1.0

    └──▷ USE IT
    Export detection rules that match a specific KQL query string, such as filtering by rule name pattern.
    shell copy

    detection-rules export --kql-export 'rule.name: "Suspicious PowerShell*"'

    Generate rule outputs using local system dates instead of UTC, useful for environments where local time context is required.
    shell copy

    detection-rules analyze --local-dates rules/*.yml

    • Adds --kql-export flag to export rules via a KQL search on name
    • Adds --local-dates flag to enable support for local dates in output

    2 details in Everything

11. dev-v1.0.0 Mar 24, 2025 · release notes

    Adds DR_CLI_MAX_WIDTH env var, Min Stack ML rules, and investigation guide generation to the detection-rules cli.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch dev-v1.0.0 https://github.com/elastic/detection-rules.git
    # already have the repo? check out this version:
    $ git checkout dev-v1.0.0

    • Adds the DR_CLI_MAX_WIDTH environment variable to control CLI output width
    • Adds new machine learning detection rules for Privileged Access Detection with Min Stack integration
    • Deprecates Cloud Defend rules

    3 details in Everything

12. dev-v0.4.0 Feb 4, 2025 · release notes

    dev-v0.4.0 adds ~30 new detection rules across AWS, Azure, and Linux kernel/process auditing.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch dev-v0.4.0 https://github.com/elastic/detection-rules.git
    # already have the repo? check out this version:
    $ git checkout dev-v0.4.0

    • New Rule Adding Coverage for Self-Created Login Profile for Root Accounts in AWS
    • New Rule Adding Coverage for Azure Entra MFA TOTP Brute Force Attempts
    • New Rule Endpoint Security Promotion Rules for Specific Events
    • New Rule PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. Version Discovery
    • New Rule Pluggable Authentication Module Creation in Unusual Directory

    +21 more show less

    • New Rule Unusual SSHD Child Process
    • New Rule Unusual Preload Environment Variable Process Execution
    • New Rule Loadable Kernel Module Configuration File Creation
    • New Rule Simple HTTP Web Server Creation
    • New Rule Simple HTTP Web Server Connection
    • New Rule Kernel Object File Creation
    • New Rule Dynamic Linker (ld.so) Creation
    • New Rule Pluggable Authentication Module Source Download
    • New Rule SSH via Backdoored System User
    • New BBR Linux System Information Discovery via Getconf
    • New Rule Suspicious Path Invocation from Command Line
    • New Rule System Binary Path File Permission Modification
    • New Rules Kernel Seeking/Unpacking Activity
    • New Rule Process Started with Executable Stack
    • New Rule GRUB Configuration File Creation
    • New Rule GRUB Configuration Generation through Built-in Utilities
    • New Rule Adding Coverage for AWS SQS Queue Purge
    • New Rule Adding Coverage for AWS EC2 Deprecated AMI Discovery
    • New Rule Adding Coverage for SNS Topic Message Publish by Rare User
    • New Rule Adding Coverage for Unusual AWS S3 Object Encryption with SSE-C
    • [Deprecation] Deprecating Potential Password Spraying of Microsoft 365 User Accounts

    26 details in Everything

13. dev-v0.3.0 Feb 4, 2025 · release notes

    dev-v0.3.0 introduces new detection rules, hunting queries, and a prerelease source connector.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch dev-v0.3.0 https://github.com/elastic/detection-rules.git
    # already have the repo? check out this version:
    $ git checkout dev-v0.3.0

    • Adds sentinel_one_cloud_funnel as a prerelease version for the data source
    • Adds investigation guide generation capability via [FR] Generate investigation guides
    • Adds new detection rule for Execution of a downloaded windows script
    • Adds new detection rule for Process Backgrounded by Unusual Parent
    • Adds new detection rule for Suspicious Usage of bpf_probe_write_user Helper

    +47 more show less

    • Adds new detection rule for File with Right-to-Left Override Character Created/Executed
    • Adds new detection rule for Unusual D-Bus Daemon Child Process
    • Adds new detection rule for Adding Coverage for AWS S3 Unauthenticated Bucket Access by Rare Source
    • Adds new detection rule for Polkit Version Discovery
    • Adds new detection rule for Polkit Policy Creation
    • Adds new detection rule for Unusual Pkexec Execution
    • Adds new detection rule for NetworkManager Dispatcher Script Creation
    • Adds new detection rule for D-Bus Service Created
    • Adds new detection rule for Manual Dracut Execution
    • Adds new detection rule for Dracut Module Creation
    • Adds new detection rule for OpenSSL Password Hash Generation
    • Adds new detection rule for Boot File Copy
    • Adds new detection rule for Initramfs Unpacking via unmkinitramfs
    • Adds new detection rule for Initramfs Extraction via CPIO
    • Adds new detection rule for Systemd Shell Execution During Boot
    • Adds new detection rule for GRUB Configuration Generation through Built-in Utilities
    • Adds new detection rule for GRUB Configuration File Creation
    • Adds new detection rule for Process Started with Executable Stack
    • Adds new detection rule for Kernel Seeking/Unpacking Activity
    • Adds new detection rule for System Binary Path File Permission Modification
    • Adds new detection rule for Suspicious Path Invocation from Command Line
    • Adds new detection rule for Linux System Information Discovery via Getconf
    • Adds new detection rule for Adding Coverage for SNSSNSAmazon Simple Notification Service, a managed pub/sub messaging service from AWS that lets tools fan out alerts or events to multiple subscribers — queues, email, HTTP endpoints, or Lambda functions — without managing broker infrastructure. Topic Message Publish by Rare User
    • Adds new detection rule for Adding Coverage for AWS EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. Deprecated AMI Discovery
    • Adds new detection rule for Adding Coverage for AWS SQS Queue Purge
    • Adds new detection rule for Sensitive Audit Policy Sub-Category Disabled
    • Adds new detection rule for Potential Process Name Stomping with Prctl
    • Adds new detection rule for SSH via Backdoored System User
    • Adds new detection rule for Pluggable Authentication Module Source Download
    • Adds new detection rule for Dynamic Linker (ld.so) Creation
    • Adds new detection rule for Kernel Object File Creation
    • Adds new detection rule for Simple HTTP Web Server Connection
    • Adds new detection rule for Simple HTTP Web Server Creation
    • Adds new detection rule for Loadable Kernel Module Configuration File Creation
    • Adds new detection rule for Unusual Preload Environment Variable Process Execution
    • Adds new detection rule for Unusual SSHD Child Process
    • Adds new detection rule for Pluggable Authentication Module Creation in Unusual Directory
    • Adds new detection rule for PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. Version Discovery
    • Adds new detection rule for Endpoint Security Promotion Rules for Specific Events
    • Adds new detection rule for Adding Coverage for Azure Entra MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. Brute Force Attempts
    • Adds new detection rule for Adding Coverage for Self-Created Login Profile for Root Accounts in AWS
    • Adds new detection rule for Adding Coverage for AWS STSAWS STSAWS Security Token Service, an Amazon Web service that issues short-lived credentials for IAM roles, letting tools authenticate to AWS APIs without storing long-term secrets. AssumeRoot by Rare User and Member Account
    • Adds new hunting query for IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Unusual Default Aviatrix Role Activity
    • Adds new hunting query for Persistence via Initramfs
    • Adds new hunting query for Persistence via GRUB Bootloader
    • Adds new hunting queries for AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. Unusual AWS Access Key Usage for User
    • Adds deprecation warnings for Experimental ML commands

    52 details in Everything

14. dev-v0.2.0 Nov 13, 2024 · release notes

    Adds 13 new detection rules including DeviceCode auth and Hex payload execution, plus Crowdstrike FDR support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch dev-v0.2.0 https://github.com/elastic/detection-rules.git
    # already have the repo? check out this version:
    $ git checkout dev-v0.2.0

    • [New] First Time Seen User Auth via DeviceCode Protocol
    • [New Rule] Potential Hex Payload Execution
    • [New Rule] Memory Swap Modification
    • [New Rule] Unusual Interactive Shell Launched from System User
    • [New Rule] Web Server Spawned via Python

    +9 more show less

    • [New Rule] Directory Creation in /bin directory
    • [New Rule] Hidden Directory Creation via Unusual Parent
    • [New Rule] Security File Access via Common Utilities
    • [New Rule] Potential Data Splitting Detected
    • [New Rule] Private Key Searching Activity
    • [New Rule] IPv4/IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. Forwarding Activity
    • [New Rule] Curl SOCKSSOCKSA proxy protocol that relays TCP (and optionally UDP) connections through an intermediary server, letting cyber tools route traffic through a pivot host or anonymizing layer without needing raw network access. Proxy Activity from Unusual Parent
    • 3rd Party EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. - Add Crowdstrike FDR support
    • Account for CCS '::' index pattern

    14 details in Everything