Search results

[Rule Tuning] M365 Security Compliance Potential Ransomware Activity

Domain: Cloud

Domain: SaaS

Integration: Microsoft 365

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Status: Open.

#5652 In elastic/detection-rules;

· terrancedejesus opened on Jan 29, 2026

[New Rule] Kernel Module Loading form Suspicious Location

community

Rule: NewProposal for new ruleProposal for new rule

Team: TRADE

Status: Open.

#5646 In elastic/detection-rules;

· litemars opened on Jan 29, 2026

[New Rule] Lateral Movement SSH tunnel

community

Rule: NewProposal for new ruleProposal for new rule

Team: TRADE

Status: Open.

#5645 In elastic/detection-rules;

· litemars opened on Jan 29, 2026

[New Rule] Defense evasion eBPF program laod

community

Rule: NewProposal for new ruleProposal for new rule

Team: TRADE

Status: Open.

#5644 In elastic/detection-rules;

· litemars opened on Jan 29, 2026

[Rule Tuning] M365 Exchange Inbox Phishing Evasion Rule Created

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#5643 In elastic/detection-rules;

· marcopedrinazzi opened on Jan 29, 2026

[Rule Tuning] M365 Exchange Inbox Forwarding Rule Created

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#5642 In elastic/detection-rules;

· marcopedrinazzi opened on Jan 29, 2026

[Rule Tuning] Microsoft 365 Inbox Forwarding Rule Created

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#5622 In elastic/detection-rules;

· GabiHausmann opened on Jan 26, 2026

[Rule Tuning] Container filesystem modification detected (4b4e9c99-27ea-4621-95c8-82341bc6e512)

genai-tradecraft

Status: Open.

#5608 In elastic/detection-rules;

· tradebot-elastic opened on Jan 24, 2026

[Rule Tuning] Network Activity to a Suspicious Top Level Domain (e516bf56-d51b-43e8-91ec-9e276331f433)

genai-tradecraft

Status: Open.

#5607 In elastic/detection-rules;

· tradebot-elastic opened on Jan 24, 2026

[Bug] Improper prebuilt rule version usage in security_detection_engine package versions

bugSomething isn't workingSomething isn't working

Status: Open.

Bug

#5601 In elastic/detection-rules;

· maximpn opened on Jan 22, 2026

CLI docs update

Status: Open.

#5599 In elastic/detection-rules;

· approksiu opened on Jan 22, 2026

[Rule Tuning] Accepted Default Telnet Port Connection (34fde489-94b0-4500-a76f-b8a157cf9269)

genai-tradecraft

Status: Open.

#5576 In elastic/detection-rules;

· tradebot-elastic opened on Jan 19, 2026