admin/elastic-detection-rules
1
0
Fork 0
mirror of https://github.com/elastic/detection-rules synced 2026-06-08 14:00:08 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
024dfd6a27772dca554bf701ac7434df6037115d
elastic-detection-rules/rules/_deprecated
T
History
Ruben Groenewoud a3638565e8 [Rule Tuning] Dormant & Deprecated Rule Clean-Up (#5672) 
* Updated kubernetes.audit.requestObject.spec.containers.image type of text to Keyword

* [Rule Tuning] Dormant & Deprecated Rule Clean-Up

* [Rule Tuning] Dormant & Deprecated Rule Clean-Up

* Few more deprecations

* ++

* Update unit test syntax fix

* Update bad bytes

* ++

(cherry picked from commit 3cba3d7982)
2026-02-05 12:28:34 +00:00
..
apm_null_user_agent.toml
[Rule Deprecation] Web Application Suspicious Activity: No User Agent (#2295)
2022-09-19 10:56:03 -07:00
command_and_control_connection_attempt_by_non_ssh_root_session.toml
[Rule Tuning] Some Tunings of several 8.9 rules (#2985)
2023-08-03 15:25:33 +02:00
command_and_control_dns_directly_to_the_internet.toml
[Deprecation rule] DNS Activity to the Internet (#2221)
2022-08-02 20:59:35 -05:00
command_and_control_ftp_file_transfer_protocol_activity_to_the_internet.toml
[Deprecation] Deprecate inherently noisy rules based on testing (#1122)
2021-04-21 15:10:06 -04:00
command_and_control_irc_internet_relay_chat_protocol_activity_to_the_internet.toml
[Deprecation] Deprecate inherently noisy rules based on testing (#1122)
2021-04-21 15:10:06 -04:00
command_and_control_linux_chisel_server_activity.toml
[Rule Tuning] Dormant & Deprecated Rule Clean-Up (#5672)
2026-02-05 12:28:34 +00:00
command_and_control_linux_iodine_activity.toml
[Rule Tuning] Linux Rules (#3092)
2023-10-23 16:28:58 +02:00
command_and_control_linux_port_knocking_reverse_connection.toml
[Tuning] Linux BBR Tuning - Part 1 (#3469)
2024-03-07 17:19:12 +01:00
command_and_control_non_standard_http_port.toml
[Rule Tuning] Dormant & Deprecated Rule Clean-Up (#5672)
2026-02-05 12:28:34 +00:00
command_and_control_non_standard_ssh_port.toml
[Rule Tuning] Dormant & Deprecated Rule Clean-Up (#5672)
2026-02-05 12:28:34 +00:00
command_and_control_port_8000_activity_to_the_internet.toml
[Deprecation] Deprecate inherently noisy rules based on testing (#1122)
2021-04-21 15:10:06 -04:00
command_and_control_pptp_point_to_point_tunneling_protocol_activity.toml
[Deprecation] Deprecate inherently noisy rules based on testing (#1122)
2021-04-21 15:10:06 -04:00
command_and_control_proxy_port_activity_to_the_internet.toml
[Deprecation] Deprecate inherently noisy rules based on testing (#1122)
2021-04-21 15:10:06 -04:00
command_and_control_smtp_to_the_internet.toml
[Deprecation] Deprecate inherently noisy rules based on testing (#1122)
2021-04-21 15:10:06 -04:00
command_and_control_sql_server_port_activity_to_the_internet.toml
[Deprecation] Deprecate inherently noisy rules based on testing (#1122)
2021-04-21 15:10:06 -04:00
command_and_control_ssh_secure_shell_from_the_internet.toml
[Rule Tuning] Rule description tweaks (#1388)
2021-07-29 10:56:13 -08:00
command_and_control_ssh_secure_shell_to_the_internet.toml
[Rule Tuning] Rule description tweaks (#1388)
2021-07-29 10:56:13 -08:00
command_and_control_tor_activity_to_the_internet.toml
[Deprecation] Deprecate inherently noisy rules based on testing (#1122)
2021-04-21 15:10:06 -04:00
credential_access_entra_signin_brute_force_microsoft_365_repeat_source.toml
[Rule Tuning] ESQL Query Field Dynamic Field Standardization (#4912)
2025-08-05 19:35:41 -04:00
credential_access_microsoft_365_potential_password_spraying_attack.toml
[Deprecation] Deprecating Potential Password Spraying of Microsoft 365 User Accounts (#4394)
2025-01-17 10:52:13 -05:00
credential_access_potential_linux_ssh_bruteforce_root.toml
DR Linux Rule Tuning 8.9 (#2859)
2023-07-10 20:02:42 +05:30
credential_access_potential_successful_linux_ftp_bruteforce.toml
[Rule Tuning] Dormant & Deprecated Rule Clean-Up (#5672)
2026-02-05 12:28:34 +00:00
credential_access_potential_successful_linux_rdp_bruteforce.toml
[Rule Tuning] Dormant & Deprecated Rule Clean-Up (#5672)
2026-02-05 12:28:34 +00:00
credential_access_tcpdump_activity.toml
[Deprecation] Deprecate inherently noisy rules based on testing (#1122)
2021-04-21 15:10:06 -04:00
defense_evasion_agent_spoofing_mismatched_id.toml
[Rule Tuning] Dormant & Deprecated Rule Clean-Up (#5672)
2026-02-05 12:28:34 +00:00
defense_evasion_attempt_to_disable_iptables_or_firewall.toml
Rule(s) deprecation as part of Linux Detection Rule Review (#2163)
2022-07-26 18:48:25 +05:30
defense_evasion_base64_encoding_or_decoding_activity.toml
[Deprecation] Deprecate inherently noisy rules based on testing (#1122)
2021-04-21 15:10:06 -04:00
defense_evasion_code_injection_conhost.toml
Revert "[Security Content] Investigation Guides Line breaks refactor (#2412)" (#2453)
2023-01-09 10:44:54 -05:00
defense_evasion_elasticache_security_group_creation.toml
[Rule Deprecations] AWS Rule Deprecations (#5568)
2026-01-20 21:09:39 +00:00
defense_evasion_elasticache_security_group_modified_or_deleted.toml
[Rule Deprecations] AWS Rule Deprecations (#5568)
2026-01-20 21:09:39 +00:00
defense_evasion_execution_via_trusted_developer_utilities.toml
[Deprecation] Trusted Developer Application Usage (#1118)
2021-04-15 22:15:38 +02:00
defense_evasion_hex_encoding_or_decoding_activity.toml
[Deprecation] Deprecate inherently noisy rules based on testing (#1122)
2021-04-21 15:10:06 -04:00
defense_evasion_ld_preload_env_variable_process_injection.toml
[Rule Tuning] Linux Rules (#3092)
2023-10-23 16:28:58 +02:00
defense_evasion_mshta_making_network_connections.toml
Add test for improper rule demotion (released production -> development) (#1555)
2021-10-19 21:47:36 -08:00
defense_evasion_potential_processherpaderping.toml
[Deprecate] Potential Process Herpaderping Attempt (#3336)
2023-12-19 15:59:48 -05:00
defense_evasion_process_termination_followed_by_deletion.toml
[Rule Tuning] Dormant & Deprecated Rule Clean-Up (#5672)
2026-02-05 12:28:34 +00:00
defense_evasion_rename_esxi_index_file.toml
[Rule Tuning] Dormant & Deprecated Rule Clean-Up (#5672)
2026-02-05 12:28:34 +00:00
defense_evasion_whitespace_padding_in_command_line.toml
Revert "[Security Content] Investigation Guides Line breaks refactor (#2412)" (#2453)
2023-01-09 10:44:54 -05:00
discovery_file_dir_discovery.toml
Revert "[Security Content] Investigation Guides Line breaks refactor (#2412)" (#2453)
2023-01-09 10:44:54 -05:00
discovery_process_discovery_via_tasklist_command.toml
[Deprecation] Process Discovery via Tasklist (#1116)
2021-04-15 22:18:56 +02:00
discovery_pspy_process_monitoring_detected.toml
[Rule Tuning] Dormant & Deprecated Rule Clean-Up (#5672)
2026-02-05 12:28:34 +00:00
discovery_query_registry_via_reg.toml
[Deprecation] Deprecate inherently noisy rules based on testing (#1122)
2021-04-21 15:10:06 -04:00
discovery_whoami_commmand.toml
[Deprecation] Deprecate inherently noisy rules based on testing (#1122)
2021-04-21 15:10:06 -04:00
execution_apt_binary.toml
[Rule tuning] Linux binary(s) shell evasion threat (#1957)
2022-05-25 08:32:53 +05:30
execution_awk_binary_shell.toml
[Rule tuning] Linux binary(s) shell evasion threat (#1957)
2022-05-25 08:32:53 +05:30
execution_busybox_binary.toml
[Rule tuning] Linux binary(s) shell evasion threat (#1957)
2022-05-25 08:32:53 +05:30
execution_c89_c99_binary.toml
[Rule tuning] Linux binary(s) shell evasion threat (#1957)
2022-05-25 08:32:53 +05:30
execution_command_shell_started_by_powershell.toml
[Deprecation] Deprecate inherently noisy rules based on testing (#1122)
2021-04-21 15:10:06 -04:00
execution_cpulimit_binary.toml
[Rule tuning] Linux binary(s) shell evasion threat (#1957)
2022-05-25 08:32:53 +05:30
execution_crash_binary.toml
[Rule tuning] Linux binary(s) shell evasion threat (#1957)
2022-05-25 08:32:53 +05:30
execution_curl_cve_2023_38545_heap_overflow.toml
[Rule Tuning] Dormant & Deprecated Rule Clean-Up (#5672)
2026-02-05 12:28:34 +00:00
execution_env_binary.toml
[Rule tuning] Linux binary(s) shell evasion threat (#1957)
2022-05-25 08:32:53 +05:30
execution_expect_binary.toml
[Rule tuning] Linux binary(s) shell evasion threat (#1957)
2022-05-25 08:32:53 +05:30
execution_find_binary.toml
[Rule tuning] Linux binary(s) shell evasion threat (#1957)
2022-05-25 08:32:53 +05:30
execution_flock_binary.toml
[Rule tuning] Linux binary(s) shell evasion threat (#1957)
2022-05-25 08:32:53 +05:30
execution_gcc_binary.toml
[Rule tuning] Linux binary(s) shell evasion threat (#1957)
2022-05-25 08:32:53 +05:30
execution_linux_process_started_in_temp_directory.toml
Rule(s) deprecation as part of Linux Detection Rule Review (#2163)
2022-07-26 18:48:25 +05:30
execution_mysql_binary.toml
[Rule tuning] Linux binary(s) shell evasion threat (#1957)
2022-05-25 08:32:53 +05:30
execution_pdf_written_file.toml
[Rule Tuning] Dormant & Deprecated Rule Clean-Up (#5672)
2026-02-05 12:28:34 +00:00
execution_reverse_shell_via_named_pipe.toml
[New Rules] Linux Reverse Shells (#2905)
2023-07-06 15:27:57 +02:00
execution_shell_suspicious_parent_child_revshell_linux.toml
[Tuning & New Rule] Linux Reverse Shell & DR Tuning (#3254)
2023-12-18 09:36:21 +01:00
execution_ssh_binary.toml
[Rule tuning] Linux binary(s) shell evasion threat (#1957)
2022-05-25 08:32:53 +05:30
execution_suspicious_jar_child_process.toml
[Deprecation] Deprecating Potential Password Spraying of Microsoft 365 User Accounts (#4394)
2025-01-17 10:52:13 -05:00
execution_vi_binary.toml
[Rule tuning] Linux binary(s) shell evasion threat (#1957)
2022-05-25 08:32:53 +05:30
execution_via_net_com_assemblies.toml
[Rule Tuning] Merge and Delete duplicate rules for Registration Utilities (#1028)
2021-03-19 10:05:09 +01:00
exfiltration_ec2_snapshot_change_activity.toml
[Rule Deprecated] Deprecated - AWS EC2 Snapshot Activity (#4913)
2025-07-18 19:35:35 -04:00
exfiltration_ec2_vm_export_failure.toml
[Rule Deprecations] AWS Rule Deprecations (#5568)
2026-01-20 21:09:39 +00:00
exfiltration_rds_snapshot_export.toml
[Bug] Tighten definitions validation patterns (#1396)
2021-10-26 10:26:20 -05:00
impact_potential_linux_ransomware_file_encryption.toml
[Rule Tuning] Misc. DR Rule Tuning (#3904)
2024-07-19 15:13:42 +02:00
impact_rds_group_deletion.toml
[Rule Deprecations] AWS Rule Deprecations (#5568)
2026-01-20 21:09:39 +00:00
impact_rds_instance_cluster_stoppage.toml
[Rule Deprecations] AWS Rule Deprecations (#5568)
2026-01-20 21:09:39 +00:00
impact_virtual_network_device_modified.toml
[Rule Deprecation] Azure Virtual Network Device Modified or Deleted (#4889)
2025-07-14 15:58:11 -04:00
initial_access_cross_site_scripting.toml
Deprecate an APM BBR rule (#4511)
2025-03-04 17:39:45 +05:30
initial_access_login_failures.toml
Rule(s) deprecation as part of Linux Detection Rule Review (#2163)
2022-07-26 18:48:25 +05:30
initial_access_login_location.toml
Rule(s) deprecation as part of Linux Detection Rule Review (#2163)
2022-07-26 18:48:25 +05:30
initial_access_login_sessions.toml
Rule(s) deprecation as part of Linux Detection Rule Review (#2163)
2022-07-26 18:48:25 +05:30
initial_access_login_time.toml
Rule(s) deprecation as part of Linux Detection Rule Review (#2163)
2022-07-26 18:48:25 +05:30
initial_access_rdp_remote_desktop_protocol_to_the_internet.toml
[Rule Tuning] Rule description tweaks (#1388)
2021-07-29 10:56:13 -08:00
initial_access_ssh_connection_established_inside_a_container.toml
Deprecate Cloud Defend Rules (#4537)
2025-03-14 21:27:37 +05:30
lateral_movement_malicious_remote_file_creation.toml
deprecating 'Malicious Remote File Creation' (#3342)
2023-12-20 08:49:45 -05:00
lateral_movement_remote_file_creation_in_sensitive_directory.toml
[Rule Deprecation] Deprecate Remote File Creation on a Sensitive Directory (#3477)
2024-04-01 11:01:20 -04:00
lateral_movement_ssh_process_launched_inside_a_container.toml
Deprecate Cloud Defend Rules (#4537)
2025-03-14 21:27:37 +05:30
lateral_movement_ssh_process_launched_inside_container.toml
[Rule Tuning] Dormant & Deprecated Rule Clean-Up (#5672)
2026-02-05 12:28:34 +00:00
linux_mknod_activity.toml
[Deprecation] Deprecate inherently noisy rules based on testing (#1122)
2021-04-21 15:10:06 -04:00
linux_nmap_activity.toml
[Deprecation] Deprecate inherently noisy rules based on testing (#1122)
2021-04-21 15:10:06 -04:00
linux_socat_activity.toml
[Deprecation] Deprecate inherently noisy rules based on testing (#1122)
2021-04-21 15:10:06 -04:00
persistence_cap_sys_admin_added_to_new_binary.toml
[Rule Tuning] Dormant & Deprecated Rule Clean-Up (#5672)
2026-02-05 12:28:34 +00:00
persistence_creation_modif_launch_deamon_sequence.toml
[Rule Tuning] Dormant & Deprecated Rule Clean-Up (#5672)
2026-02-05 12:28:34 +00:00
persistence_creation_of_kernel_module.toml
[Rule Tuning] Dormant & Deprecated Rule Clean-Up (#5672)
2026-02-05 12:28:34 +00:00
persistence_credential_access_modify_auth_module_or_config.toml
[Rule Tuning] Dormant & Deprecated Rule Clean-Up (#5672)
2026-02-05 12:28:34 +00:00
persistence_cron_jobs_creation_and_runtime.toml
[Deprecation] Deprecate inherently noisy rules based on testing (#1122)
2021-04-21 15:10:06 -04:00
persistence_etc_file_creation.toml
[Deprecation] Suspicious File Creation in /etc for Persistence (#4850)
2025-06-27 10:14:53 +02:00
persistence_google_workspace_user_group_access_modified_to_allow_external_access.toml
deprecate 'Google Workspace User Group Access Modified to Allow External Access' (#2576)
2023-03-02 11:29:14 -05:00
persistence_kernel_module_activity.toml
[Deprecation] Deprecate inherently noisy rules based on testing (#1122)
2021-04-21 15:10:06 -04:00
persistence_rds_cluster_creation.toml
[Rule Deprecations] AWS Rule Deprecations (#5568)
2026-01-20 21:09:39 +00:00
persistence_rds_group_creation.toml
[Rule Deprecations] AWS Rule Deprecations (#5568)
2026-01-20 21:09:39 +00:00
persistence_rds_instance_creation.toml
[Rule Deprecations] AWS Rule Deprecations (#5568)
2026-01-20 21:09:39 +00:00
persistence_redshift_instance_creation.toml
[Rule Deprecations] AWS Rule Deprecations (#5568)
2026-01-20 21:09:39 +00:00
persistence_shell_activity_by_web_server.toml
[Rule Tuning] Potential Shell via Web Server (#2585)
2023-05-05 09:47:49 +02:00
privilege_escalation_gcp_kubernetes_rolebindings_created_or_patched.toml
[Deprecation] GCP Kubernetes Rolebindings Created or Patched (#2340)
2022-11-09 12:51:52 -05:00
privilege_escalation_krbrelayup_suspicious_logon.toml
[Deprecated Rule] Potential Privilege Escalation via Local Kerberos R… (#2209)
2022-08-01 18:28:26 +02:00
privilege_escalation_linux_strace_activity.toml
Rule tuning as part of Linux Detection Rules Review (#2170)
2022-07-29 21:55:49 +05:30
privilege_escalation_linux_uid_int_max_bug.toml
[Rule Tuning] Dormant & Deprecated Rule Clean-Up (#5672)
2026-02-05 12:28:34 +00:00
privilege_escalation_netcon_via_sudo_binary.toml
[Rule Tuning] Dormant & Deprecated Rule Clean-Up (#5672)
2026-02-05 12:28:34 +00:00
privilege_escalation_printspooler_malicious_driver_file_changes.toml
Deprecate PrintNightmare Rules (#1852)
2022-03-17 19:39:36 -03:00
privilege_escalation_printspooler_malicious_registry_modification.toml
Deprecate PrintNightmare Rules (#1852)
2022-03-17 19:39:36 -03:00
privilege_escalation_root_login_without_mfa.toml
[Deprecation] Deprecated - AWS Root Login Without MFA (#5351)
2025-11-24 10:01:40 -05:00
privilege_escalation_setgid_bit_set_via_chmod.toml
Add tests to ensure rules are properly deprecated (#1050)
2021-03-16 21:31:33 -08:00
threat_intel_filebeat7x.toml
Revert "[Security Content] Investigation Guides Line breaks refactor (#2412)" (#2453)
2023-01-09 10:44:54 -05:00
threat_intel_filebeat8x.toml
[Deprecation] Threat Intel Indicator Match - General Rules (#2901)
2023-07-18 20:12:53 -03:00
threat_intel_fleet_integrations.toml
[Deprecation] Threat Intel Indicator Match - General Rules (#2901)
2023-07-18 20:12:53 -03:00