Skip to content

Actions: elastic/detection-rules

backport

Actions

Loading...
Loading

Show workflow options

Create status badge

Loading
5,249 workflow runs
5,249 workflow runs

Filter by Event

Filter by Status

Filter by Branch

Filter by Actor

[New Rule] Python Site or User Customize File Creation
backport #12816: Pull request #4500 closed by Aegrah
March 3, 2025 14:30 5m 13s
March 3, 2025 14:30 5m 13s
[New Rule] Python Path File (pth) Creation
backport #12815: Pull request #4499 closed by Aegrah
March 3, 2025 14:20 5m 10s
March 3, 2025 14:20 5m 10s
[New Rule] Successful SSH Authentication from Unusual User
backport #12814: Pull request #4481 closed by Aegrah
March 3, 2025 10:55 5m 6s
March 3, 2025 10:55 5m 6s
[New] WDAC Policy File by an Unusual Process
backport #12813: Pull request #4504 labeled by botelastic bot
February 28, 2025 18:30 45s
February 28, 2025 18:30 45s
[New] WDAC Policy File by an Unusual Process
backport #12812: Pull request #4504 labeled by Samirbous
February 28, 2025 18:30 51s
February 28, 2025 18:30 51s
[New] WDAC Policy File by an Unusual Process
backport #12811: Pull request #4504 opened by Samirbous
February 28, 2025 18:30 49s
February 28, 2025 18:30 49s
[New] WDAC Policy File by an Unusual Process
backport #12810: Pull request #4504 labeled by Samirbous
February 28, 2025 18:30 49s
February 28, 2025 18:30 49s
[Rule Tuning] Remove hardcoded logic from description
backport #12809: Pull request #4503 closed by w0rk3r
February 28, 2025 17:38 5m 3s
February 28, 2025 17:38 5m 3s
[Rule Tuning] Remove hardcoded logic from description
backport #12808: Pull request #4503 opened by w0rk3r
February 28, 2025 15:24 44s
February 28, 2025 15:24 44s
[Rule Tuning] Remove hardcoded logic from description
backport #12807: Pull request #4503 labeled by w0rk3r
February 28, 2025 15:24 44s
February 28, 2025 15:24 44s
[Rule Tuning] Remove hardcoded logic from description
backport #12806: Pull request #4503 labeled by w0rk3r
February 28, 2025 15:24 51s
February 28, 2025 15:24 51s
[Rule Tuning] Remove hardcoded logic from description
backport #12805: Pull request #4503 labeled by w0rk3r
February 28, 2025 15:24 47s
February 28, 2025 15:24 47s
[New Rule] Kill Command Execution
backport #12804: Pull request #4485 closed by Aegrah
February 28, 2025 10:26 5m 15s
February 28, 2025 10:26 5m 15s
[New Rule] Unusual File Transfer Utility Launched
backport #12803: Pull request #4487 closed by Aegrah
February 28, 2025 10:15 5m 43s
February 28, 2025 10:15 5m 43s
[New Rule] Base64 Decoded Payload Piped to Interpreter
backport #12802: Pull request #4488 closed by Aegrah
February 28, 2025 10:01 5m 8s
February 28, 2025 10:01 5m 8s
[New Rule] Unusual Base64 Encoding/Decoding Activity
backport #12801: Pull request #4486 closed by Aegrah
February 28, 2025 09:09 5m 4s
February 28, 2025 09:09 5m 4s
[New Rule] Successful SSH Authentication from Unusual IP-Address
backport #12800: Pull request #4482 closed by Aegrah
February 28, 2025 08:55 5m 29s
February 28, 2025 08:55 5m 29s
[New Rule] Successful SSH Authentication from Unusual SSH Public Key
backport #12799: Pull request #4478 closed by Aegrah
February 28, 2025 08:44 5m 15s
February 28, 2025 08:44 5m 15s
[New Rule] Linux User Account Credential Modification
backport #12798: Pull request #4484 closed by Aegrah
February 27, 2025 15:42 5m 7s
February 27, 2025 15:42 5m 7s
[New Rule] SSH Authorized Keys File Deletion
backport #12797: Pull request #4483 closed by Aegrah
February 27, 2025 15:29 5m 47s
February 27, 2025 15:29 5m 47s
[Tuning] Remote File Copy to a Hidden Share
backport #12796: Pull request #4494 closed by w0rk3r
February 27, 2025 14:50 5m 23s
February 27, 2025 14:50 5m 23s
[Tuning] Potential Antimalware Scan Interface Bypass via PowerShell
backport #12795: Pull request #4477 closed by w0rk3r
February 27, 2025 14:36 5m 4s
February 27, 2025 14:36 5m 4s
[Rule Tuning] Sysmon rules that uses event.action
backport #12794: Pull request #4496 closed by w0rk3r
February 27, 2025 14:24 5m 21s
February 27, 2025 14:24 5m 21s
Prep for Release 9.0
backport #12793: Pull request #4502 labeled by shashank-elastic
February 27, 2025 11:51 41s
February 27, 2025 11:51 41s
Prep for Release 9.0
backport #12792: Pull request #4502 labeled by botelastic bot
February 27, 2025 11:46 1m 1s
February 27, 2025 11:46 1m 1s