Elastic Security Detection Rules

Elastic Security Detection Rules

Elastic Security detection rules help users to set up and get their detections and security monitoring going as soon as possible. Elastic is committed to transparency and openness(opens in a new tab or window) with the security community, which is why we build and maintain our detection logic publicly.

See our docs(opens in a new tab or window) for more information on how to enable these detection rules in Elastic Security.

Domains

Filter by 6 Domains

Rule Types

Filter by 4 Rule Types

Operating Systems

Filter by 3 Operating Systems

Use Cases

Filter by 19 Use Cases

Tactics

Filter by 14 Tactics

Data Sources

Filter by 56 Data Sources

Rapid Secret Retrieval Attempts from AWS SecretsManager

Multiple Okta Sessions Detected for a Single User

Query Registry using Built-in Tools

Azure Entra MFA TOTP Brute Force Attempts

AWS IAM User Created Access Keys For Another User

GitHub Protected Branch Settings Changed

GitHub App Deleted

High Number of Cloned GitHub Repos From PAT

GitHub UEBA - Multiple Alerts from a GitHub Account

New GitHub App Installed

GitHub Repository Deleted

New GitHub Owner Added

GitHub Owner Role Granted To User

Privilege Escalation via SUID/SGID

Potential Sudo Token Manipulation via Process Injection

First Occurrence GitHub Event for a Personal Access Token (PAT)

First Occurrence of Private Repo Event from Specific GitHub Personal Access Token (PAT)

First Occurrence of GitHub User Interaction with Private Repo

GitHub Repo Created

First Occurrence of GitHub Repo Interaction From a New IP

Member Removed From GitHub Organization

GitHub PAT Access Revoked

GitHub User Blocked From Organization

First Occurrence of IP Address For GitHub Personal Access Token (PAT)

First Occurrence of IP Address For GitHub User

First Occurrence of User Agent For a GitHub Personal Access Token (PAT)

First Occurrence of User-Agent For a GitHub User

First Occurrence of Personal Access Token (PAT) Use For a GitHub User

New User Added To GitHub Organization

Attempted Bypass of Okta MFA

Attempts to Brute Force an Okta User Account

Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy

Multiple Device Token Hashes for Single Okta Session

Multiple Okta User Authentication Events with Client Address

Multiple Okta User Authentication Events with Same Device Token Hash

Okta Brute Force or Password Spraying Attack

Potential Okta MFA Bombing via Push Notifications

High Number of Okta Device Token Cookies Generated for Authentication

Potentially Successful MFA Bombing via Push Notifications

Okta User Session Impersonation

Attempt to Deactivate an Okta Network Zone

Attempt to Delete an Okta Network Zone

Unauthorized Scope for Public App OAuth2 Token Grant with Client Credentials

Attempt to Deactivate an Okta Policy

Attempt to Deactivate an Okta Policy Rule

Attempt to Delete an Okta Policy

Attempt to Delete an Okta Policy Rule

Attempt to Modify an Okta Network Zone

Attempt to Modify an Okta Policy

Attempt to Modify an Okta Policy Rule

High Number of Okta User Password Reset or Unlock Attempts

Attempt to Revoke Okta API Token

Attempt to Deactivate an Okta Application

Attempt to Delete an Okta Application

Attempt to Modify an Okta Application

Possible Okta DoS Attack

First Occurrence of Okta User Session Started via Proxy

New Okta Authentication Behavior Detected

Okta FastPass Phishing Detection

Unauthorized Access to an Okta Application

Okta User Sessions Started from Different Geolocations

Okta Sign-In Events via Third-Party IdP

Successful Application SSO from Rare Unknown Client Device

Suspicious Activity Reported by Okta User

Okta ThreatInsight Threat Suspected Promotion

Administrator Privileges Assigned to an Okta Group

Administrator Role Assigned to an Okta User

Attempt to Create Okta API Token

Attempt to Reset MFA Factors for an Okta User Account

MFA Deactivation with no Re-Activation for Okta User Account

New Okta Identity Provider (IdP) Added by Admin

Modification or Removal of an Okta Application Sign-On Policy

Stolen Credentials Used to Login to Okta Account After MFA Reset

Suspicious pbpaste High Volume Activity

User Added to the Admin Group

Possible Consent Grant Attack via Azure-Registered Application

AWS IAM Login Profile Added for Root

Endpoint Security (Elastic Defend)

Memory Threat - Detected - Elastic Defend

Memory Threat - Prevented- Elastic Defend

Behavior - Detected - Elastic Defend

Behavior - Prevented - Elastic Defend

Malicious File - Detected - Elastic Defend

Malicious File - Prevented - Elastic Defend

Ransomware - Detected - Elastic Defend

Ransomware - Prevented - Elastic Defend

AWS Bedrock Invocations without Guardrails Detected by a Single User Over a Session

AWS STS AssumeRoot by Rare User and Member Account

Unusual High Confidence Content Filter Blocks Detected

Unusual High Denied Sensitive Information Policy Blocks Detected

Unusual High Denied Topic Blocks Detected

Unusual High Word Policy Blocks Detected

AWS SSM `SendCommand` with Run Shell Command Parameters

AWS CloudTrail Log Deleted

AWS EC2 Multi-Region DescribeInstances API Calls

AWS Discovery API Calls via CLI from a Single Resource

AWS STS GetCallerIdentity API Called for the First Time

First Time AWS Cloudformation Stack Creation by User

AWS SSM Command Document Created by Rare User

Showing up to 100 rules. Use the options at the top of the page to further fine the 1274 rules matching your current search settings.