elastic-detection-rules

mirror of https://github.com/elastic/detection-rules synced 2026-06-08 14:00:08 +00:00

Files

T

Samirbous aacdbd14aa [New] Kubernetes Secrets List Across Cluster or Sensitive Namespaces (#5966 )

* [New] Kubernetes Secrets List Across Cluster or Sensitive Namespaces

Detects `list` operations on Kubernetes Secrets from a non-loopback client when the request URI targets cluster-wide secrets or list operations under `kube-system` or `default`. Useful for spotting broad secret enumeration from remote clients.

* Update credential_access_kubernetes_secrets_list_cluster_and_sensitive_namespaces.toml

* Update credential_access_kubernetes_secrets_list_cluster_and_sensitive_namespaces.toml

* Update rules/integrations/kubernetes/credential_access_kubernetes_secrets_list_cluster_and_sensitive_namespaces.toml

Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>

---------

Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>

(cherry picked from commit 55f91946ec)

2026-05-02 09:58:43 +00:00

aws

[New] Diverse AWS rules (#5913 )

2026-05-01 21:00:39 +00:00

aws_bedrock

[Tuning] Add mv_expand for gen_ai.policy.action field (#5296 )

2025-11-11 07:37:40 +05:30

azure

Prep for Release 9.4 (#5965 )

2026-04-22 18:46:33 +00:00

azure_openai

[Rule Tuning] Updated ESQL Rules Based on Validation Results (#5151 )