Commits

Commit history

1. Commits on Oct 26, 2026

   • [New Rule] Package Runtime Secret File Access Followed by IMDS Request (#7083)

     Show description for eb500af
     Mikaayenson

     authored
     eb500afView commit details

     Copy full SHA for eb500af

     Browse repository at this point

   • [Bug] Fix updated date unit tests on PRs not to main (#6925)

     Show description for c65a38f
     

     eric-forte-elastic

     and

     Mikaayenson

     authored
     c65a38fView commit details

     Copy full SHA for c65a38f

     Browse repository at this point

   • [New] VS Code rules (#7084)

     Show description for b5f1a56
     

     4 peopleauthored
     b5f1a56View commit details

     Copy full SHA for b5f1a56

     Browse repository at this point
2. Commits on Oct 24, 2026

   • Revert "[New Rule] Package Runtime Secret File Access Followed by IMDS Request"

     Show description for 52ef7a0
     Mikaayenson

     committed
     52ef7a0View commit details

     Copy full SHA for 52ef7a0

     Browse repository at this point

   • [New Rule] Package Runtime Secret File Access Followed by IMDS Request

     Mikaayenson

     committed
     e9e0020View commit details

     Copy full SHA for e9e0020

     Browse repository at this point
3. Commits on Oct 23, 2026

   • Fix rule AsciiDoc build failure (#7082)

     Show description for 8049d3b
     

     shashank-elastic

     and

     Mikaayenson

     authored
     8049d3bView commit details

     Copy full SHA for 8049d3b

     Browse repository at this point

   • [Rule Tuning] Azure AD Graph Potential Enumeration (ROADrecon) (#6993)

     Show description for 926cdcc
     

     terrancedejesus

     and

     Copilot

     authored
     926cdccView commit details

     Copy full SHA for 926cdcc

     Browse repository at this point

   • Lock versions for releases: 8.19,9.3,9.4,9.5 (#7078)

     Show description for 93525a4
     

     github-actions[bot]

     and

     shashank-elastic

     authored
     93525a4View commit details

     Copy full SHA for 93525a4

     Browse repository at this point

   • [Bug] Naive split causing value error in attack.py (#6908)

     Show description for f8a874e
     

     eric-forte-elastic

     and

     Mikaayenson

     authored
     f8a874eView commit details

     Copy full SHA for f8a874e

     Browse repository at this point

   • [Rule Tuning] Work around EQL optional-field bug and fix data source compatibility (#6998)

     Show description for 46482a5
     

     w0rk3r

     and

     Aegrah

     authored
     46482a5View commit details

     Copy full SHA for 46482a5

     Browse repository at this point

   • [New Rules] RMM Network Rules (#6866)

     Show description for 1d08c82
     

     eric-forte-elastic

     and

     w0rk3r

     authored
     1d08c82View commit details

     Copy full SHA for 1d08c82

     Browse repository at this point

   • Modify risk score and severity in Netscaler rule (#7074)

     Show description for 6571e4e
     Samirbous

     authored
     6571e4eView commit details

     Copy full SHA for 6571e4e

     Browse repository at this point

   • [Rule Tuning] Linux Firewall Rule Creation or Modification (#7073)

     Show description for 587fffe
     Aegrah

     authored
     587fffeView commit details

     Copy full SHA for 587fffe

     Browse repository at this point

   • [Rule Tuning] AWS SSM Session Manager Child Process Execution (#7051)

     Show description for e429547
     

     tradebot-elastic

     and

     bryans3c

     authored
     e429547View commit details

     Copy full SHA for e429547

     Browse repository at this point

   • [New Rules] Detonate FNs (#6972)

     Show description for 1b18e9c
     

     Aegrah

     and

     Copilot

     authored
     1b18e9cView commit details

     Copy full SHA for 1b18e9c

     Browse repository at this point

   • Never reuse a rule version that has already shipped to a stack (#7061)

     Show description for 0cc9729
     shashank-elastic

     authored
     0cc9729View commit details

     Copy full SHA for 0cc9729

     Browse repository at this point

   • [Tuning] Web Shell Detection: Script Process Child of Common Web Processes (#7062)

     Show description for 50a946a
     

     3 peopleauthored
     50a946aView commit details

     Copy full SHA for 50a946a

     Browse repository at this point
4. Commits on Oct 22, 2026

   • [New Rules] Add PHP2Shell and web server crash detections (#7063)

     Show description for 2b30453
     

     3 peopleauthored
     2b30453View commit details

     Copy full SHA for 2b30453

     Browse repository at this point

   • Add investigation guides (#7065)

     shashank-elastic

     authored
     1df4299View commit details

     Copy full SHA for 1df4299

     Browse repository at this point
5. Commits on Oct 21, 2026

   • [Rule Tuning] M365 Exchange MFA Notification Email Deleted or Moved (workflow 348f091a-b374-4ce5-9fed-79af6a3d0cb6) (#7024)

     tradebot-elastic

     authored
     9431b80View commit details

     Copy full SHA for 9431b80

     Browse repository at this point

   • [New Rule] Azure AKS Multi-Resource Setup Discovery (#6580)

     Show description for b63ce4c
     

     terrancedejesus

     and

     Copilot

     authored
     b63ce4cView commit details

     Copy full SHA for b63ce4c

     Browse repository at this point

   • [Bug] Register MITRE ATLAS as a 9.6 stack_emit epoch (#7022)

     Show description for fb7f864
     Mikaayenson

     authored
     fb7f864View commit details

     Copy full SHA for fb7f864

     Browse repository at this point

   • [Rule Tuning] Systemd Service Override Configuration File Created (workflow dec4d052-41b5-465b-8bd6-e0e8580a3301) (#7044)

     tradebot-elastic

     authored
     8d16da3View commit details

     Copy full SHA for 8d16da3

     Browse repository at this point

   • [New Rules] AWS EKS Audit Coverage - Part 5 (#6991)

     Show description for 87e2056
     bryans3c

     authored
     87e2056View commit details

     Copy full SHA for 87e2056

     Browse repository at this point

   • [New Rules] AWS EKS Audit Coverage - Part 4 (#6990)

     Show description for 4ddee39
     

     bryans3c

     and

     terrancedejesus

     authored
     4ddee39View commit details

     Copy full SHA for 4ddee39

     Browse repository at this point

   • [New Rules] AWS EKS Audit Coverage - Part 3 (#6989)

     Show description for 4b963c7
     bryans3c

     authored
     4b963c7View commit details

     Copy full SHA for 4b963c7

     Browse repository at this point

   • [New Rules] AWS EKS Audit Coverage - Part 2 (#6988)

     Show description for 6aeb279
     

     bryans3c

     and

     terrancedejesus

     authored
     6aeb279View commit details

     Copy full SHA for 6aeb279

     Browse repository at this point

   • [New Rules] AWS EKS Audit Coverage - Part 1 (#6987)

     Show description for 7115bb0
     bryans3c

     authored
     7115bb0View commit details

     Copy full SHA for 7115bb0

     Browse repository at this point

   • [Rule Tuning] Linux Firewall Rule Creation or Modification (workflow b1ac2ff5-04d4-4389-83c0-e2529196ec3b) (#6947)

     tradebot-elastic

     authored
     002bd25View commit details

     Copy full SHA for 002bd25

     Browse repository at this point
6. Commits on Oct 20, 2026

   • [Rule Tuning] First Seen External MQTT Broker Connection (#6964)

     Show description for 54669d2
     

     eric-forte-elastic

     and

     bryans3c

     authored
     54669d2View commit details

     Copy full SHA for 54669d2

     Browse repository at this point

   • [New Rule] Suspicious Linux Process Connection to AWS IoT Core MQTT (#6965)

     Show description for 8d22ef1
     

     3 peopleauthored
     8d22ef1View commit details

     Copy full SHA for 8d22ef1

     Browse repository at this point

   • [Rule Tuning] Windows Misc Tunings - 2 (#6962)

     w0rk3r

     authored
     c6d1199View commit details

     Copy full SHA for c6d1199

     Browse repository at this point

   • [Rule Tuning] Windows Misc Tunings - 3 (#7015)

     Show description for c5d5bf4
     w0rk3r

     authored
     c5d5bf4View commit details

     Copy full SHA for c5d5bf4

     Browse repository at this point

   • [Rule Tuning] M365 Identity Login from Atypical Region (#7017)

     Show description for fa781ee
     

     tradebot-elastic

     and

     terrancedejesus

     authored
     fa781eeView commit details

     Copy full SHA for fa781ee

     Browse repository at this point
7. Commits on Oct 19, 2026

   • [New Rule] Entra ID Application Self-Assigned to Privileged Role (#7014)

     Show description for 3cff483
     terrancedejesus

     authored
     3cff483View commit details

     Copy full SHA for 3cff483

     Browse repository at this point