Skip to content

Actions: elastic/detection-rules

Actions

Unit Tests

Actions

Loading...
Loading

Show workflow options

Create status badge

Loading
pythonpackage.yml
2,500+ workflow runs
2,500+ workflow runs

Filter by Event

⌥ + click/return to exclude

Filter by Status

⌥ + click/return to exclude

Filter by Branch

⌥ + click/return to exclude

Filter by Actor

⌥ + click/return to exclude
Extend Potential Linux Backdoor User Account Creation to useradd/adduser Unit Tests #52125: Pull request #6954 synchronize by alireza-mandegar
Action required alireza-mandegar:tune-linux-backdoor-user-creation
alireza-mandegar:tune-linux-backdoor-user-creation
Action required
[Rule Tuning] Agent Spoofing - Multiple Hosts Using Same Agent Unit Tests #52124: Pull request #7006 opened by tradebot-elastic
13m 31s tuning/493834ca-f861-414c-8602-150d5505b777
tuning/493834ca-f861-414c-8602-150d5505b777
13m 31s
Update dependency pre-commit to v4.7.0 Unit Tests #52123: Pull request #7005 opened by elastic-renovate-prod Bot
10m 13s renovate/pre-commit-4.x
renovate/pre-commit-4.x
10m 13s
Tunes Svchost spawning Cmd to close two evasion gaps: Unit Tests #52122: Pull request #7001 reopened by abdelghafourbouhdyd
Action required abdelghafourbouhdyd:rules-tunning
abdelghafourbouhdyd:rules-tunning
Action required
adding a rule for defensive evasion iso mounted from zip temp directory Unit Tests #52121: Pull request #7003 opened by adminsb42
2m 23s adminsb42:defense_evasion_iso_mounted_from_zip_temp_directory
adminsb42:defense_evasion_iso_mounted_from_zip_temp_directory
2m 23s
Tunes Svchost spawning Cmd to close two evasion gaps: Unit Tests #52120: Pull request #7001 synchronize by abdelghafourbouhdyd
14h 39m 34s abdelghafourbouhdyd:rules-tunning
abdelghafourbouhdyd:rules-tunning
14h 39m 34s
Update dependency python to 3.15 Unit Tests #52119: Pull request #7002 opened by elastic-renovate-prod Bot
13m 5s renovate/python-3.x
renovate/python-3.x
13m 5s
Tunes Svchost spawning Cmd to close two evasion gaps: Unit Tests #52118: Pull request #7001 reopened by abdelghafourbouhdyd
18h 3m 1s abdelghafourbouhdyd:rules-tunning
abdelghafourbouhdyd:rules-tunning
18h 3m 1s
Tunes Svchost spawning Cmd to close two evasion gaps: Unit Tests #52117: Pull request #7001 opened by abdelghafourbouhdyd
38m 52s abdelghafourbouhdyd:rules-tunning
abdelghafourbouhdyd:rules-tunning
38m 52s
[Rule Tuning] Azure AD Graph Potential Enumeration (ROADrecon) Unit Tests #52116: Pull request #6993 synchronize by terrancedejesus
11m 3s rule-tuning/entra-aad-graph-roadrecon-evade-resistant
rule-tuning/entra-aad-graph-roadrecon-evade-resistant
11m 3s
[Rule Tuning] Azure AD Graph Potential Enumeration (ROADrecon) Unit Tests #52115: Pull request #6993 synchronize by terrancedejesus
13m 10s rule-tuning/entra-aad-graph-roadrecon-evade-resistant
rule-tuning/entra-aad-graph-roadrecon-evade-resistant
13m 10s
Update dependency ruff to v0.17.0 Unit Tests #52114: Pull request #6940 synchronize by elastic-renovate-prod Bot
12m 52s renovate/ruff-0.x
renovate/ruff-0.x
12m 52s
[New Rules] Add OpenAI ChatGPT Enterprise detection rules Unit Tests #52113: Pull request #6966 synchronize by Mikaayenson
8m 16s rules/openai-chatgpt-enterprise-genai
rules/openai-chatgpt-enterprise-genai
8m 16s
[New Rules/Tuning] Windows Atomic credential, discovery and execution coverage Unit Tests #52112: Pull request #6999 opened by django-88
12m 30s codex/atomic-windows-siem-pack-20261009
codex/atomic-windows-siem-pack-20261009
12m 30s
[Rule Tuning] Work around EQL optional-field bug and fix data source compatibility Unit Tests #52111: Pull request #6998 synchronize by w0rk3r
13m 16s rt_6
rt_6
13m 16s
[Rule Tuning] Work around EQL optional-field bug and fix data source compatibility Unit Tests #52110: Pull request #6998 opened by w0rk3r
4m 10s rt_6
rt_6
4m 10s
[New Rules] Add OpenAI ChatGPT Enterprise detection rules Unit Tests #52109: Pull request #6966 synchronize by Mikaayenson
12m 31s rules/openai-chatgpt-enterprise-genai
rules/openai-chatgpt-enterprise-genai
12m 31s
[New Rule] Potential Prompt Injection Coercing Shell Execution Unit Tests #52108: Pull request #6997 opened by Mikaayenson
13m 5s rule/potential-prompt-injection-coercing-shell-execution
rule/potential-prompt-injection-coercing-shell-execution
13m 5s
[Rule Tuning] Azure AD Graph Potential Enumeration (ROADrecon) Unit Tests #52107: Pull request #6993 synchronize by terrancedejesus
9m 38s rule-tuning/entra-aad-graph-roadrecon-evade-resistant
rule-tuning/entra-aad-graph-roadrecon-evade-resistant
9m 38s
[Rule Tuning] Azure AD Graph Potential Enumeration (ROADrecon) Unit Tests #52106: Pull request #6993 synchronize by terrancedejesus
8m 6s rule-tuning/entra-aad-graph-roadrecon-evade-resistant
rule-tuning/entra-aad-graph-roadrecon-evade-resistant
8m 6s
[Rule Tuning] Azure AD Graph Potential Enumeration (ROADrecon) Unit Tests #52105: Pull request #6993 synchronize by terrancedejesus
12m 59s rule-tuning/entra-aad-graph-roadrecon-evade-resistant
rule-tuning/entra-aad-graph-roadrecon-evade-resistant
12m 59s
[New Rule] Entra ID Primary Refresh Token Used by a Command-Line Client (ROADtools PRT replay) Unit Tests #52104: Pull request #6996 opened by terrancedejesus
6m 26s new-rule/entra-prt-used-by-cli-client
new-rule/entra-prt-used-by-cli-client
6m 26s
[Rule Tuning] ROADtools Device Registration Detections Unit Tests #52103: Pull request #6995 opened by terrancedejesus
12m 39s rule-tuning/entra-roadtools-device-registration
rule-tuning/entra-roadtools-device-registration
12m 39s
[New Rule] Entra ID Passkey Registration Detections (ROADtools registerpasskey) Unit Tests #52102: Pull request #6994 opened by terrancedejesus
4m 12s new-rule/entra-passkey-registration-detections
new-rule/entra-passkey-registration-detections
4m 12s
[Rule Tuning] Azure AD Graph Potential Enumeration (ROADrecon) Unit Tests #52101: Pull request #6993 opened by terrancedejesus
12m 52s rule-tuning/entra-aad-graph-roadrecon-evade-resistant
rule-tuning/entra-aad-graph-roadrecon-evade-resistant
12m 52s