Skip to content
Navigation Menu
Sign in
Appearance settings
Platform
AI CODE CREATION
GitHub Copilot
Write better code with AI
GitHub Copilot app
Direct agents from issue to merge
MCP Registry
Integrate external tools
DEVELOPER WORKFLOWS
Actions
Automate any workflow
Codespaces
Instant dev environments
Issues
Plan and track work
Code Review
Manage code changes
Code Quality
Enforce quality at merge
APPLICATION SECURITY
GitHub Advanced Security
Find and fix vulnerabilities
Code security
Secure your code as you build
Secret protection
Stop leaks before they start
EXPLORE
Why GitHub
Documentation
Blog
Changelog
Marketplace
View all features
Solutions
BY COMPANY SIZE
Enterprises
Small and medium teams
Startups
Nonprofits
BY USE CASE
App Modernization
DevSecOps
DevOps
CI/CD
View all use cases
BY INDUSTRY
Healthcare
Financial services
Manufacturing
Government
View all industries
View all solutions
Resources
EXPLORE BY TOPIC
AI
Software Development
DevOps
Security
View all topics
EXPLORE BY TYPE
Customer stories
Events & webinars
Ebooks & reports
Business insights
GitHub Skills
SUPPORT & SERVICES
Documentation
Customer support
Community forum
Trust center
Partners
View all resources
Open Source
COMMUNITY
GitHub Sponsors
Fund open source developers
PROGRAMS
Security Lab
Maintainer Community
Accelerator
GitHub Stars
Archive Program
REPOSITORIES
Topics
Trending
Collections
Enterprise
ENTERPRISE SOLUTIONS
Enterprise platform
AI-powered developer platform
AVAILABLE ADD-ONS
GitHub Advanced Security
Enterprise-grade security features
Copilot for Business
Enterprise-grade AI features
Premium Support
Enterprise-grade 24/7 support
Pricing
Type
/
to search
Sign in
Sign up
Appearance settings
You signed in with another tab or window.
Reload
to refresh your session.
You signed out in another tab or window.
Reload
to refresh your session.
You switched accounts on another tab or window.
Reload
to refresh your session.
Dismiss alert
{{ message }}
Uh oh!
There was an error while loading.
Please reload this page
.
Third-Wave-Innovations
/
elastic_detection-rules
Public
forked from
elastic/detection-rules
Notifications
You must be signed in to change notification settings
Fork
0
Star
0
Code
Pull requests
0
Actions
Projects
Security and quality
0
Insights
Additional navigation options
Code
Pull requests
Actions
Projects
Security and quality
Insights
Files
Expand file tree
main
Breadcrumbs
elastic_detection-rules
/
rules
/
_deprecated
/
Copy path
Directory actions
More options
More options
Directory actions
More options
More options
Latest commit
History
History
History
main
Breadcrumbs
elastic_detection-rules
/
rules
/
_deprecated
/
Copy path
Top
Folders and files
Name
Name
Last commit message
Last commit date
parent directory
..
apm_null_user_agent.toml
apm_null_user_agent.toml
command_and_control_connection_attempt_by_non_ssh_root_session.toml
command_and_control_connection_attempt_by_non_ssh_root_session.toml
command_and_control_dns_directly_to_the_internet.toml
command_and_control_dns_directly_to_the_internet.toml
command_and_control_ftp_file_transfer_protocol_activity_to_the_internet.toml
command_and_control_ftp_file_transfer_protocol_activity_to_the_internet.toml
command_and_control_irc_internet_relay_chat_protocol_activity_to_the_internet.toml
command_and_control_irc_internet_relay_chat_protocol_activity_to_the_internet.toml
command_and_control_linux_iodine_activity.toml
command_and_control_linux_iodine_activity.toml
command_and_control_linux_port_knocking_reverse_connection.toml
command_and_control_linux_port_knocking_reverse_connection.toml
command_and_control_port_8000_activity_to_the_internet.toml
command_and_control_port_8000_activity_to_the_internet.toml
command_and_control_pptp_point_to_point_tunneling_protocol_activity.toml
command_and_control_pptp_point_to_point_tunneling_protocol_activity.toml
command_and_control_proxy_port_activity_to_the_internet.toml
command_and_control_proxy_port_activity_to_the_internet.toml
command_and_control_smtp_to_the_internet.toml
command_and_control_smtp_to_the_internet.toml
command_and_control_sql_server_port_activity_to_the_internet.toml
command_and_control_sql_server_port_activity_to_the_internet.toml
command_and_control_ssh_secure_shell_from_the_internet.toml
command_and_control_ssh_secure_shell_from_the_internet.toml
command_and_control_ssh_secure_shell_to_the_internet.toml
command_and_control_ssh_secure_shell_to_the_internet.toml
command_and_control_tor_activity_to_the_internet.toml
command_and_control_tor_activity_to_the_internet.toml
credential_access_potential_linux_ssh_bruteforce_root.toml
credential_access_potential_linux_ssh_bruteforce_root.toml
credential_access_tcpdump_activity.toml
credential_access_tcpdump_activity.toml
defense_evasion_attempt_to_disable_iptables_or_firewall.toml
defense_evasion_attempt_to_disable_iptables_or_firewall.toml
defense_evasion_base64_encoding_or_decoding_activity.toml
defense_evasion_base64_encoding_or_decoding_activity.toml
defense_evasion_code_injection_conhost.toml
defense_evasion_code_injection_conhost.toml
defense_evasion_execution_via_trusted_developer_utilities.toml
defense_evasion_execution_via_trusted_developer_utilities.toml
defense_evasion_hex_encoding_or_decoding_activity.toml
defense_evasion_hex_encoding_or_decoding_activity.toml
defense_evasion_ld_preload_env_variable_process_injection.toml
defense_evasion_ld_preload_env_variable_process_injection.toml
defense_evasion_mshta_making_network_connections.toml
defense_evasion_mshta_making_network_connections.toml
defense_evasion_potential_processherpaderping.toml
defense_evasion_potential_processherpaderping.toml
defense_evasion_whitespace_padding_in_command_line.toml
defense_evasion_whitespace_padding_in_command_line.toml
discovery_file_dir_discovery.toml
discovery_file_dir_discovery.toml
discovery_process_discovery_via_tasklist_command.toml
discovery_process_discovery_via_tasklist_command.toml
discovery_query_registry_via_reg.toml
discovery_query_registry_via_reg.toml
discovery_whoami_commmand.toml
discovery_whoami_commmand.toml
execution_apt_binary.toml
execution_apt_binary.toml
execution_awk_binary_shell.toml
execution_awk_binary_shell.toml
execution_busybox_binary.toml
execution_busybox_binary.toml
execution_c89_c99_binary.toml
execution_c89_c99_binary.toml
execution_command_shell_started_by_powershell.toml
execution_command_shell_started_by_powershell.toml
execution_cpulimit_binary.toml
execution_cpulimit_binary.toml
execution_crash_binary.toml
execution_crash_binary.toml
execution_env_binary.toml
execution_env_binary.toml
execution_expect_binary.toml
execution_expect_binary.toml
execution_find_binary.toml
execution_find_binary.toml
execution_flock_binary.toml
execution_flock_binary.toml
execution_gcc_binary.toml
execution_gcc_binary.toml
execution_linux_process_started_in_temp_directory.toml
execution_linux_process_started_in_temp_directory.toml
execution_mysql_binary.toml
execution_mysql_binary.toml
execution_reverse_shell_via_named_pipe.toml
execution_reverse_shell_via_named_pipe.toml
execution_shell_suspicious_parent_child_revshell_linux.toml
execution_shell_suspicious_parent_child_revshell_linux.toml
execution_ssh_binary.toml
execution_ssh_binary.toml
execution_vi_binary.toml
execution_vi_binary.toml
execution_via_net_com_assemblies.toml
execution_via_net_com_assemblies.toml
exfiltration_rds_snapshot_export.toml
exfiltration_rds_snapshot_export.toml
impact_potential_linux_ransomware_file_encryption.toml
impact_potential_linux_ransomware_file_encryption.toml
initial_access_login_failures.toml
initial_access_login_failures.toml
initial_access_login_location.toml
initial_access_login_location.toml
initial_access_login_sessions.toml
initial_access_login_sessions.toml
initial_access_login_time.toml
initial_access_login_time.toml
initial_access_rdp_remote_desktop_protocol_to_the_internet.toml
initial_access_rdp_remote_desktop_protocol_to_the_internet.toml
lateral_movement_malicious_remote_file_creation.toml
lateral_movement_malicious_remote_file_creation.toml
lateral_movement_remote_file_creation_in_sensitive_directory.toml
lateral_movement_remote_file_creation_in_sensitive_directory.toml
linux_mknod_activity.toml
linux_mknod_activity.toml
linux_nmap_activity.toml
linux_nmap_activity.toml
linux_socat_activity.toml
linux_socat_activity.toml
persistence_cron_jobs_creation_and_runtime.toml
persistence_cron_jobs_creation_and_runtime.toml
persistence_google_workspace_user_group_access_modified_to_allow_external_access.toml
persistence_google_workspace_user_group_access_modified_to_allow_external_access.toml
persistence_kernel_module_activity.toml
persistence_kernel_module_activity.toml
persistence_shell_activity_by_web_server.toml
persistence_shell_activity_by_web_server.toml
privilege_escalation_gcp_kubernetes_rolebindings_created_or_patched.toml
privilege_escalation_gcp_kubernetes_rolebindings_created_or_patched.toml
privilege_escalation_krbrelayup_suspicious_logon.toml
privilege_escalation_krbrelayup_suspicious_logon.toml
privilege_escalation_linux_strace_activity.toml
privilege_escalation_linux_strace_activity.toml
privilege_escalation_printspooler_malicious_driver_file_changes.toml
privilege_escalation_printspooler_malicious_driver_file_changes.toml
privilege_escalation_printspooler_malicious_registry_modification.toml
privilege_escalation_printspooler_malicious_registry_modification.toml
privilege_escalation_setgid_bit_set_via_chmod.toml
privilege_escalation_setgid_bit_set_via_chmod.toml
threat_intel_filebeat7x.toml
threat_intel_filebeat7x.toml
threat_intel_filebeat8x.toml
threat_intel_filebeat8x.toml
threat_intel_fleet_integrations.toml
threat_intel_fleet_integrations.toml
View all files
You can’t perform that action at this time.