elastic-detection-rules

mirror of https://github.com/elastic/detection-rules synced 2026-06-08 14:00:08 +00:00

Files

T

Samirbous bbc54141f5 [New] Suspicious Kubernetes Pod Exec (#5978 )

* [New] Kubernetes Pod Exec with Curl or Wget to HTTPS

Detects pod or attach `exec` API calls where the decoded request query implies curl or wget fetching an https URL (avoid noisy local http services).

* Create execution_kubernetes_pod_exec_potential_reverse_shell.toml

* Update execution_kubernetes_pod_exec_curl_wget_https.toml

* Update execution_kubernetes_pod_exec_potential_reverse_shell.toml

* ++

* ++

* Apply suggestion from @terrancedejesus

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Apply suggestion from @terrancedejesus

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Apply suggestion from @terrancedejesus

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Apply suggestion from @terrancedejesus

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Apply suggestion from @terrancedejesus

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Apply suggestion from @terrancedejesus

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

* Update execution_kubernetes_pod_exec_curl_wget_https.toml

* Update execution_kubernetes_pod_exec_potential_reverse_shell.toml

* Update credential_access_kubernetes_pod_exec_cloud_instance_metadata.toml

* Update credential_access_kubernetes_pod_exec_sensitive_file_access.toml

* Update execution_kubernetes_pod_exec_curl_wget_https.toml

* Update credential_access_kubernetes_pod_exec_sensitive_file_access.toml

* Update credential_access_kubernetes_pod_exec_cloud_instance_metadata.toml

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

(cherry picked from commit e4746c3a83)

2026-05-04 21:45:08 +00:00

aws

[New] Diverse AWS rules (#5913 )

2026-05-01 20:59:54 +00:00

aws_bedrock

[Tuning] Add mv_expand for gen_ai.policy.action field (#5296 )

2025-11-11 02:11:34 +00:00

azure

Prep for Release 9.4 (#5965 )

2026-04-22 18:45:36 +00:00

azure_openai

[Rule Tuning] Updated ESQL Rules Based on Validation Results (#5151 )