Search results

[Rule Tuning] Program Files Directory Masquerading (32c5cf9c-2ef8-4e87-819e-5ccb7cd18b14)

genai-tradecraft

Status: Open.

#5725 In elastic/detection-rules;

· tradebot-elastic opened on Feb 12, 2026

[Rule Tuning] Okta Credential Stuffing, Password Spraying, and Brute Force Detection Improvements

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Status: Open.

#5722 In elastic/detection-rules;

· terrancedejesus opened on Feb 11, 2026

[Rule Deprecation] M365 Teams Guest & External Access Rules

Domain: SaaS

Domain: Web

Integration: Microsoft 365

Rule: Deprecationremoval of a ruleremoval of a rule

Status: Open.

#5720 In elastic/detection-rules;

· terrancedejesus opened on Feb 11, 2026

[FR] D4C Rules are Erroneously Added to deprecated_rules.json

enhancementNew feature or requestNew feature or request

Team: TRADE

Status: Open.

Enhancement

#5714 In elastic/detection-rules;

· eric-forte-elastic opened on Feb 10, 2026

[Rule Tuning] Suspicious Windows Powershell Arguments - Tenable/Nessus agent

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#5713 In elastic/detection-rules;

· richlv opened on Feb 10, 2026

[Rule Tuning] Sensitive Audit Policy Sub-Category Disabled

community

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Team: TRADE

Status: Open.

#5703 In elastic/detection-rules;

· CherrabiNesrine opened on Feb 9, 2026

[Rule Tuning] Entra ID Federated Identity Credential Persistence Detection

Domain: Identity

Integration: Azureazure related rulesazure related rules

Rule: NewProposal for new ruleProposal for new rule

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Status: Open.

#5701 In elastic/detection-rules;

· terrancedejesus opened on Feb 9, 2026

[Rule Tuning] Command and Scripting Interpreter via Windows Scripts (2d62889e-e758-4c5e-b57e-c735914ee32a)

genai-tradecraft

Status: Open.

#5695 In elastic/detection-rules;

· tradebot-elastic opened on Feb 8, 2026

[Rule Tuning] Entra ID Suspicious Cloud Device Registration

Domain: Identity

Integration: Azureazure related rulesazure related rules

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Status: Open.

#5682 In elastic/detection-rules;

· terrancedejesus opened on Feb 5, 2026

[Rule Tuning] Entra ID SharePoint Accessed by Unusual User and Microsoft Authentication Broker Client

Domain: Cloud

Domain: Identity

Integration: Azureazure related rulesazure related rules

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Status: Open.

#5680 In elastic/detection-rules;

· terrancedejesus opened on Feb 4, 2026

[Rule Tuning] Deprecate Individual MSFT Defender Rules / Create BBR MSFT Defender Rule

Domain: Identity

Integration: Microsoft 365

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Status: Open.

#5678 In elastic/detection-rules;

· terrancedejesus opened on Feb 4, 2026

[Rule Tuning] M365 Identity Excessive SSO Login Errors Reported

Domain: Identity

Integration: Microsoft 365

Rule: Tuningtweaking or tuning an existing ruletweaking or tuning an existing rule

Status: Open.

#5676 In elastic/detection-rules;

· terrancedejesus opened on Feb 4, 2026