All pull requests

Pull requests

• Bump setuptools from 84.0.0 to 84.1.0

  backport: autocommunitydependenciesminorpython
  #7088·dependabot[bot] opened Oct 26, 2026Bot·

  ·
  1

• [New Rule] [Rule Tuning] Entra ID device registration: default hostname BBR and unusual user agent

  backport: autobbrDomain: CloudDomain: IdentityIntegration: AzureRule: NewRule: Tuning
  #7087·terrancedejesus opened Oct 26, 2026Contributor·2 tasks done·

  ·
  2

  

• [Rule Tuning] Unusual Parent-Child Relationship

  backport: autocurrentreleaseDomain: Endpointgenai-tradecraftOS: WindowsRule: Tuning
  #7086·tradebot-elastic opened Oct 26, 2026Contributor·

  ·
  5

  

• [Bug] Fixing metadata across macOS detection rules

  bugDomain: EndpointOS: macOSTeam: TRADE
  #7085·litemars opened Oct 26, 2026Contributor·

  ·
  1

  

• [New Rule] Memory Fault Crash in Web Server Process

  backport: autoDomain: EndpointOS: WindowsRule: New
  #7081·w0rk3r opened Oct 23, 2026Contributor·

  ·
  3

  

• [New Rules] Add GenAI cloud parity (Bedrock, Foundry, Vertex, ChatGPT Enterprise)

  backport: autoDomain: CloudDomain: GenAIIntegration: AWSIntegration: AWS-BedrockIntegration: AzureIntegration: GCPIntegration: Microsoft FoundryIntegration: OpenAI ChatGPT EnterprisepatchRule: New
  #7080·Mikaayenson opened Oct 23, 2026Contributor·1 task done·

  ·
  11

  

• [Rule Tuning] Git Repository or File Download to Suspicious Directory

  backport: autocurrentreleaseDomain: Endpointgenai-tradecraftOS: LinuxRule: Tuning
  #7079·tradebot-elastic opened Oct 23, 2026Contributor·

  ·
  3

  

• [New Rule] Discovery Commands Followed by Instance Metadata Service Access

  backport: autoDomain: EndpointOS: LinuxOS: macOSOS: WindowsRule: NewTeam: TRADE
  #7075·litemars opened Oct 23, 2026Contributor·

  ·
  27

  

• [New Rule, Rule Tuning] Linux Session Environment Configuration Coverage

  #7072·Aegrah opened Oct 23, 2026Contributor·6 of 7 tasks·

  ·
  5

  

• [Rule Tuning] Linux Network Event Hook File Activity

  #7071·Aegrah opened Oct 23, 2026Contributor·5 of 6 tasks·

  ·
  2

  

• [New Rule] Linux System Lifecycle Hook File Activity

  #7070·Aegrah opened Oct 23, 2026Contributor·5 of 6 tasks·

  ·
  3

  

• [New Rule] Linux Graphical Session Hook File Activity

  #7069·Aegrah opened Oct 23, 2026Contributor·5 of 6 tasks·

  ·
  3

  

• [Rule Tuning] Temporarily Scheduled Task Creation

  backport: autoDomain: Endpointgenai-tradecraftOS: WindowsRule: Tuning
  #7068·tradebot-elastic opened Oct 23, 2026Contributor·

  ·
  4

  

• [Rule Tuning] Potential PowerShell Obfuscated Script via High Entropy

  backport: autoDomain: Endpointgenai-tradecraftOS: WindowsRule: Tuning
  #7067·tradebot-elastic opened Oct 22, 2026Contributor·

  ·
  1

  

• [New Rule] Potential AD CS NTLM Relay or Dollar-Account Certificate Issuance

  backport: autoIntegration: WindowsOS: WindowsRule: New
  #7064·django-88 opened Oct 22, 2026Contributor·

  ·
  2

  

• [New Rule] Entra ID FIDO2 Passkey Credential Registered

  backport: autobbrDomain: CloudDomain: IdentityIntegration: AzureRule: New
  #7060·terrancedejesus opened Oct 22, 2026Contributor·

  ·
  4

  

• [New Rule] Entra ID Passkey Sign-In with Unusual Authenticator AAGUID

  backport: autoDomain: CloudDomain: IdentityIntegration: AzureRule: New
  #7059·terrancedejesus opened Oct 22, 2026Contributor·

  ·
  6

  

• [New Rule] Entra ID Passkey Sign-In with Nonattestable Authenticator AAGUID

  backport: autoDomain: CloudDomain: IdentityIntegration: AzureRule: New
  #7058·terrancedejesus opened Oct 22, 2026Contributor·

  ·
  9

  

• [New Rule] Entra ID FIDO2 Passkey Registered Outside the Self-Service Portal

  backport: autoDomain: CloudDomain: IdentityIntegration: AzureRule: New
  #7057·terrancedejesus opened Oct 22, 2026Contributor·

  ·
  4

  

• [New Rule] Entra ID Non-Passkey Sign-In with Unusual Browser and OS Combination

  backport: autoDomain: CloudDomain: IdentityIntegration: AzureRule: New
  #7056·terrancedejesus opened Oct 22, 2026Contributor·

  ·
  6

  

• [New Rule] Entra ID Potential Passkey Downgrade

  backport: autoDomain: CloudDomain: IdentityIntegration: AzureRule: New
  #7055·terrancedejesus opened Oct 22, 2026Contributor·

  ·
  4

  

• [New Rule] Blockchain RPC Lookup by Node or Python Followed by Child Process

  backport: autocommunity
  #7054·popkir opened Oct 21, 2026·2 tasks done·

  ·
  1

• [Rule Tuning] Loadable Kernel Module Configuration File Activity

  #7050·Aegrah opened Oct 21, 2026Contributor·6 tasks done·

  ·
  2

  

• [New Rule] Linux Command History File Deletion

  #7049·Aegrah opened Oct 21, 2026Contributor·8 tasks done·

  ·
  3

  

• [New Rule] Unusual Hidden Payload Execution via systemd

  #7048·Aegrah opened Oct 21, 2026Contributor·7 tasks done·

  ·
  2