Issues

• [Bug] Naive split causing value error in attack.py

  bugcommunityTeam: TRADE
  elastic/detection-rules#6906 · Filter by author sudo-d4s3 opened on Sep 25, 2026
  1

  

• [Rule Tuning] Elastic Defend Alert Followed by Telemetry Loss

  communityRule: TuningTeam: TRADE
  elastic/detection-rules#6846 · Filter by author HeroGamers opened on Sep 21, 2026
  

• [Rule Tuning] Multiple Alerts in Different ATT&CK Tactics on a Single Host (29531d20-0e80-41d4-9ec6-d6b58e4a475c)

  communityRule: TuningTeam: TRADE
  elastic/detection-rules#6792 · Filter by author Holmness opened on Sep 15, 2026
  3

  

• [FR] Support EU DORA & NIST CSF 2.0 Compliance Tags and FAIR Financial Risk Metadata in Rule Schemas

  community
  elastic/detection-rules#6732 · Filter by author AAH20 opened on Sep 4, 2026
  1

• [Rule Tuning] Potential Shadow Credentials added to AD Object

  Rule: TuningTeam: TRADE
  Task

  elastic/detection-rules#6726 · Filter by author w0rk3r opened on Sep 2, 2026
  

• [New Rules] Druva Data Security Cloud detection coverage

  community
  elastic/detection-rules#6725 · Filter by author ramachandrankaruppasamy opened on Sep 1, 2026

• [New Rule] AWS Bedrock AgentCore Cross-Actor User Preference Memory Access

  communityRule: NewTeam: TRADE
  elastic/detection-rules#6722 · Filter by author kedarmohile opened on Sep 1, 2026

• [DaC] TOML data only contains date instead of datatime

  communitydetections-as-codepythonTeam: TRADE
  elastic/detection-rules#6672 · Filter by author wingiti opened on Aug 19, 2026
  3

• [Rule Tuning] Potential Password Spraying Attack via SSH

  communityRule: TuningTeam: TRADE
  elastic/detection-rules#6664 · Filter by author Snowstreamer opened on Aug 17, 2026
  

• [New Rule] Dual-signal Suricata/SnortML triage (GID 411 ML ≠ signature TP)

  community
  elastic/detection-rules#6661 · Filter by author AAH20 opened on Aug 16, 2026

• [New Rule] Browser Credential Database Query via Database CLI Utility

  community
  elastic/detection-rules#6618 · Filter by author clivoa opened on Aug 7, 2026

• [New Rule] Unusual Child Process of Homebrew's Bundled Ruby Interpreter

  community
  elastic/detection-rules#6617 · Filter by author clivoa opened on Aug 7, 2026

• [New Rule] Untrusted Process Access to Cryptocurrency Wallet Data

  community
  elastic/detection-rules#6616 · Filter by author clivoa opened on Aug 7, 2026

• [New Rule] Native Binary Creation Under node_modules

  community
  elastic/detection-rules#6609 · Filter by author clivoa opened on Aug 5, 2026
  1

• [New Rule] Potential Non-Browser Process Connection to a DNS-over-HTTPS Resolver

  community
  elastic/detection-rules#6608 · Filter by author clivoa opened on Aug 5, 2026
  1

• [Rule Tuning] Initial Access via File Upload Followed by GET Request

  community
  elastic/detection-rules#6606 · Filter by author clivoa opened on Aug 5, 2026

• [Rule Tuning] Elastic Defend Alert from Package Manager Install Ancestry

  community
  elastic/detection-rules#6605 · Filter by author clivoa opened on Aug 5, 2026

• [New hunt] Novel TLS Destination Domain from a Build Host

  community
  elastic/detection-rules#6604 · Filter by author clivoa opened on Aug 5, 2026

• [New Rule] Shai-Hulud Exfiltration Artifact File Creation

  community
  elastic/detection-rules#6602 · Filter by author clivoa opened on Aug 5, 2026
  2

• [New Rule] Package Registry Credential File Referenced on a Command Line

  community
  elastic/detection-rules#6601 · Filter by author clivoa opened on Aug 5, 2026
  4

• [New Rule] Composer Install Script Execution

  community
  elastic/detection-rules#6600 · Filter by author clivoa opened on Aug 5, 2026
  2

• [New hunt] Lockfile Modified by Unexpected Process

  community
  elastic/detection-rules#6599 · Filter by author clivoa opened on Aug 5, 2026

• [New hunt] Web Root File Write Burst by a Web Server Process

  community
  elastic/detection-rules#6598 · Filter by author clivoa opened on Aug 5, 2026
  1

• [New hunt] Rare Child Process of a Web Server Process

  community
  elastic/detection-rules#6597 · Filter by author clivoa opened on Aug 5, 2026
  1

• [New Rule] Potential Webshell Command Execution via URL Query Parameter

  community
  elastic/detection-rules#6596 · Filter by author clivoa opened on Aug 5, 2026
  3