Search results

[Rule Tuning] Entra ID OAuth Authorization Code Grant for Unusual User, App, and Resource

Domain: Cloud

Domain: Identity

Integration: Azureazure related rulesazure related rules

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Status: Open.

#5588 In elastic/detection-rules;

· terrancedejesus opened on Jan 20, 2026

[Rule Tuning] M365 Threat Intelligence Signal

Domain: Cloud

Domain: SaaS

Integration: Microsoft 365

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Status: Open.

#5586 In elastic/detection-rules;

· terrancedejesus opened on Jan 20, 2026

[Rule Tuning] Entra ID OAuth Phishing via First-Party Microsoft Application

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#5584 In elastic/detection-rules;

· rkarimovs opened on Jan 20, 2026

[Rule Tuning] Accepted Default Telnet Port Connection (34fde489-94b0-4500-a76f-b8a157cf9269)

genai-tradecraft

Status: Open.

#5576 In elastic/detection-rules;

· tradebot-elastic opened on Jan 19, 2026

[Rule Tuning] Execution via Windows Subsystem for Linux (db7dbad5-08d2-4d25-b9b1-d3a1e4a15efd)

genai-tradecraft

Status: Open.

#5575 In elastic/detection-rules;

· tradebot-elastic opened on Jan 19, 2026

[Rule Tuning] Unsigned DLL Side-Loading from a Suspicious Folder (58b0d8e5534f62bfc51f8de8ca370dc1b8699e69)

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#5572 In elastic/detection-rules;

· ailiffa opened on Jan 17, 2026

[Hunt Tuning] Fix Invalid ES|QL Syntax in Hunting Queries

Hunt: Tuning

Status: Open.

#5565 In elastic/detection-rules;

· terrancedejesus opened on Jan 16, 2026

[FR] [DAC] Consideration: Safeguards for Kibana Rule Loading Race Conditions

community

detections-as-code

enhancementNew feature or requestNew feature or request

pythonInternal python for the repositoryInternal python for the repository

Team: TRADE

Status: Open.

Enhancement

#5564 In elastic/detection-rules;

· eric-forte-elastic opened on Jan 16, 2026

[Rule Tuning] Svchost spawning Cmd

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#5538 In elastic/detection-rules;

· rkarimovs opened on Jan 8, 2026

[Bug] [DAC] Rule Action Email Strings Incorrectly Handled

bugSomething isn't workingSomething isn't working

community

detections-as-code

Team: TRADE

Status: Open.

Bug

#5529 In elastic/detection-rules;

· eric-forte-elastic opened on Jan 6, 2026

[Rule Tuning] Component Object Model Hijacking

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#5526 In elastic/detection-rules;

· b3at1 opened on Jan 2, 2026

[Rule Tuning] Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score (994e40aa-8c85-43de-825e-15f665375ee8)

genai-tradecraft

Status: Open.

#5523 In elastic/detection-rules;

· tradebot-elastic opened on Jan 2, 2026