[![ATT&CK navigator coverage](https://img.shields.io/badge/ATT&CK-Navigator-red.svg)](https://ela.st/protections-artifacts-navigator)
<h1><img src="https://static-www.elastic.co/v3/assets/bltefdd0b53724fa2ce/blt786d938064f8c8be/5e0e7b96fb35e665aed32798/logo-endpoint-32-color.svg"/>  Protections Artifacts</h1>


Elastic Security prevents ransomware and malware, detects advanced threats, and arms responders with vital context. It’s free and open, ready for every endpoint.

Protections-Artifacts is the home of our detection logic (rules, yara, etc) for [Elastic Security for endpoint](https://www.elastic.co/security/endpoint-security). At Elastic, we believe that being open and transparent is critical for the success of us and our users. Check out our [blog post](https://www.elastic.co/blog/continued-leadership-in-open-and-transparent-security) if you are interested in additional background.

# Directory

Below you will find the artifacts we have opened in this repository:

| Folder | Description |
| ------ | ----------- |
| [`behavior/`](behavior/) | EQL based malicious behavior rules |
| [`yara/`](yara) | Yara rules for malware protection |
| [`ransomware/`](ransomware/) | Elastic ransomware protection artifact  |

# Questions? Problems? Suggestions?

If you would like you to provide feedback or contribute to this repository, please familiarize yourself with the applicable artifact’s readme and [open an issue](https://github.com/elastic/protections-artifacts/issues/new/choose) using one of the provided templates. We cannot accept pull requests at this time because this repository is automatically generated.

You can also reach us in our [Slack Workspace](https://www.elastic.co/blog/join-our-elastic-stack-workspace-on-slack) or in the [Security Discuss](https://discuss.elastic.co/c/security/) forum.

# License

Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one or more contributor license agreements. Licensed under the Elastic License 2.0; you may not use these artifacts except in compliance with the Elastic License 2.0

Contributors must sign a [Contributor License Agreement](https://www.elastic.co/contributor-agreement) before contributing code to any Elastic repositories.