mirror of https://github.com/elastic/detection-rules synced 2026-06-08 14:00:08 +00:00

Files

T

Samirbous 9a2a449a2c [New] Azure Run Command Correlated with Process Execution (#6169 )

* [New] Azure Run Command Correlated with Process Execution

Correlates successful Azure Virtual Machine Run Command operations with endpoint PowerShell execution on the same host within two minutes. Adversaries abuse Run Command to run scripts remotely as SYSTEM while activity logs only record the control-plane action; Elastic Defend process telemetry reveals the on-guest payload.

* Update execution_azure_vm_run_command_powershell_unrestricted_script.toml

* Update execution_azure_vm_run_command_powershell_unrestricted_script.toml

* ++

* Update execution_azure_vm_run_command_powershell_unrestricted_script.toml

* Update rules/cross-platform/execution_azure_run_command_script_child_process.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Update rules/cross-platform/execution_azure_run_command_script_child_process.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

(cherry picked from commit e9b167d117)

2026-06-01 13:46:33 +00:00

_deprecated

[Rule Tuning] Dormant & Deprecated Rule Clean-Up (#5672 )

2026-02-05 13:24:21 +01:00

apm

[FR] Generate investigation guides (#4358 )

2025-01-22 11:17:38 -06:00

cross-platform

[New] Azure Run Command Correlated with Process Execution (#6169 )

2026-06-01 13:46:33 +00:00

integrations

[Rule Tuning] Forwarded Google Workspace Security Alert (#6166 )

2026-06-01 13:31:06 +00:00

linux

[Rule Tuning] Attempt to Clear Kernel Ring Buffer (#6221 )

2026-06-01 12:09:53 +00:00

macos

[Rule Tuning] Not ECS field in rule Suspicious Web Browser Sensitive File Access (#6200 )

2026-06-01 11:15:33 +00:00

Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794 )

2026-04-02 09:25:14 -04:00

network

[Rule Tuning] Abnormally Large DNS Response (#6201 )

2026-05-28 18:40:25 +00:00

promotions

[Rule Tuning] Add Supplemental Mitre Mappings (#5876 )

2026-04-01 09:12:42 -05:00

threat_intel

[Rule Tuning] Reduce Severity from Critical to High (#4637 )

2025-05-06 21:37:47 +05:30

windows

[Rule Tuning] Fix ESQL Rules with Conflicting Lookback Windows (#6179 )

2026-05-22 18:37:36 +00:00

README.md

[FR] Minor Typo Fixes (#5784 )

2026-03-06 16:12:45 -06:00

README.md

rules/

Rules within this folder are organized by solution or platform. The structure is flattened out, because nested file hierarchies are hard to navigate and find what you're looking for. Each directory contains several .toml files, and the primary ATT&CK tactic is included in the file name when it's relevant (i.e. windows/execution_via_compiled_html_file.toml)

folder	description
`.`	Root directory where rules are stored
`apm/`	Rules that use Application Performance Monitoring (APM) data sources
`cross-platform/`	Rules that apply to multiple platforms, such as Windows and Linux
`integrations/`	Rules organized by Fleet integration
`linux/`	Rules for Linux or other Unix based operating systems
`macos/`	Rules for macOS
`ml/`	Rules that use machine learning jobs (ML)
`network/`	Rules that use network data sources
`promotions/`	Rules that promote external alerts into detection engine alerts
`windows/`	Rules for the Microsoft Windows Operating System

Integration specific rules are stored in the integrations/ directory:

folder	integration
`aws/`	Amazon Web Services (AWS)
`azure/`	Microsoft Azure
`cyberarkpas/`	Cyber Ark Privileged Access Security
`endpoint/`	Elastic Endpoint Security
`gcp/`	Google Cloud Platform (GCP)
`google_workspace/`	Google Workspace (formerly GSuite)
`o365/`	Microsoft Office
`okta/`	Okta