elastic-detection-rules

mirror of https://github.com/elastic/detection-rules synced 2026-06-08 14:00:08 +00:00

Files

T

Samirbous 19a67a2b8f [New] Nsenter to PID 1 Namespace via Auditd/D4C (#5988 )

* [New] Nsenter to PID 1 Namespace via Auditd

we have an existing rule https://github.com/elastic/detection-rules/blob/0f521a0848420844f3af383f1dee8481d41b2e5b/rules/linux/privilege_escalation_docker_escape_via_nsenter.toml#L15 (compatible only with Elastic Defend `process.entry_leader.entry_meta.type == "container"`).

This rule is compatible with the auditd integration and scoped to Init/systemd PID namespace commonly targeted for container escape.

* Create privilege_escalation_nsenter_execution_inside_container.toml

* Update privilege_escalation_auditd_nsenter_target_host_pid.toml

* Update privilege_escalation_auditd_nsenter_target_host_pid.toml

* Update privilege_escalation_auditd_nsenter_target_host_pid.toml

* Update privilege_escalation_auditd_nsenter_target_host_pid.toml

* Update rules/linux/privilege_escalation_auditd_nsenter_target_host_pid.toml

Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>

* Update privilege_escalation_nsenter_execution_inside_container.toml

* Update privilege_escalation_auditd_nsenter_target_host_pid.toml

---------

Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>

(cherry picked from commit 838e926058)

2026-05-02 14:00:12 +00:00

aws

[New] Diverse AWS rules (#5913 )

2026-05-01 21:01:32 +00:00

aws_bedrock

[Tuning] Add mv_expand for gen_ai.policy.action field (#5296 )

2025-11-11 07:37:40 +05:30

azure

Prep for Release 9.4 (#5965 )

2026-04-22 18:47:16 +00:00

azure_openai

[Rule Tuning] Updated ESQL Rules Based on Validation Results (#5151 )