Skip to content

dev-v2.2.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 08 Sep 12:52
· 225 commits to refs/heads/main since this release
dev-v2.2.0
5dd2ce4
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Changes

🚀 Features

🐛 Bug Fixes

  • [Bug] [DaC] ignore_ssl_errors treated as string and query type not supported with --required-only (#6636) @eric-forte-elastic

🛠 Internal Changes

🔍 Hunting Updates

  • [New Hunt] AKS Kubelet nodes/proxy Command Execution from an External Source IP (#6460) @terrancedejesus

What's Changed

  • [New Hunt] AKS Kubelet nodes/proxy Command Execution from an External Source IP by @terrancedejesus in #6460
  • Update Guide For Newly Observed RC4 Kerberos Service Ticket Request by @shashank-elastic in #6628
  • Lock versions for releases: 8.19,9.3,9.4,9.5 by @github-actions[bot] in #6630
  • [New Rule] GCP IAM Service Account Impersonation Role Granted by @Aryu-RU in #6215
  • [Rule Tuning] Entra ID High Risk Sign-in by @terrancedejesus in #6638
  • [New Rule] Potential CertiGhost AD CS Machine Identity Mismatch (CVE-2026-54121) by @w0rk3r in #6644
  • [chore] Post PR guidelines only for community PRs by @Mikaayenson in #6623
  • [Rule Tuning] Migrate COMPLETION rules to EIS Claude Sonnet 4.6 by @Mikaayenson in #6614
  • [Rule Tuning] GenAI or MCP Server Child Process Execution by @Mikaayenson in #6632
  • [New Rule] PKINIT Followed by Same-Principal U2U Service Ticket by @w0rk3r in #6649
  • Lock versions for releases: 8.19,9.3,9.4,9.5 by @github-actions[bot] in #6666
  • [New Rule] Kernel Module Loaded with Tainting Flags by @Aegrah in #6588
  • [Rule Tuning] Entra ID User Sign-in with Unusual Non-Managed Device by @terrancedejesus in #6639
  • [Rule Tuning] Elastic Agent Service Terminated by @w0rk3r in #6663
  • [New Rule] Process Execution Followed by Self-Deletion by @Aegrah in #6676
  • [New Rule] File Downloaded by Curl/Wget and Piped to Interpreter by @Aegrah in #6674
  • [Bug] [DaC] ignore_ssl_errors treated as string and query type not supported with --required-only by @eric-forte-elastic in #6636
  • [Deprecation] Windows Misc Rules by @w0rk3r in #6677
  • [Rule Tuning] Rare Connection to WebDAV Target by @w0rk3r in #6669
  • [New Rule] Suspicious Process Execution by Zoom on macOS or Linux by @eric-forte-elastic in #6643
  • [FR] Add free text support to KQL by @eric-forte-elastic in #6487
  • [Rule Tuning] Linux Clipboard Activity Detected by @Aegrah in #6686
  • [Rule Tunings] Add IaC/automation UA exclusions to 54 AWS detection rules by @bryans3c in #6589
  • [Rule Tuning] Suspicious /proc/maps Discovery by @Aegrah in #6694
  • [Rule Tuning] Unusual File Creation via Web Server by @Mikaayenson in #6678
  • [Rule Tuning] Web Server Potential SQL Injection Request by @Mikaayenson in #6625
  • [Rule Tuning] Potential Computer Account NTLM Relay Activity by @Mikaayenson in #6631
  • [Rule Tuning] Potential Timestomp in Executable Files by @Mikaayenson in #6521
  • [Rule Tunings] K8s small fixes by @imays11 in #6671
  • [New Rule] GCP Secret Manager ListSecrets Across Multiple Projects by @imays11 in #6642
  • [Deprecation] K8s overlap rules, GKE TokenRequest, and GWS MFA duplicate by @imays11 in #6687
  • [New Rule] First Seen SonicWall Remote Access Login by User and Source by @eric-forte-elastic in #6688
  • [Rule Tuning] IPSEC NAT Traversal Port Activity by @eric-forte-elastic in #6629
  • [Rule Tuning] Entra ID OAuth user_impersonation Scope for Unusual User and Client by @terrancedejesus in #6641
  • [Rule Tuning] Entra ID User Sign-in with Unusual Client by @terrancedejesus in #6640
  • [Rule Tuning] Entra ID SharePoint or OneDrive Accessed by Unusual Client by @terrancedejesus in #6645
  • [Rule Tuning] Entra ID User Sign-in with Unusual Authentication Type by @terrancedejesus in #6646
  • [New Rule] Self-Signed TLS Certificate Recently Issued on External Connection by @eric-forte-elastic in #6685
  • [New Rule] Potential DNS Rebinding from Public to Private Address by @eric-forte-elastic in #6683
  • [New Rule] Potential DNS Tunneling via Long and Unique Subdomains by @eric-forte-elastic in #6684
  • [New Rule] AWS Detective Graph Deleted by @bryans3c in #6654
  • [New Rule] AWS GuardDuty Publishing Destination Deleted by @bryans3c in #6655
  • [New Rule] AWS EKS Access Entry Created Then Deleted by Same Identity by @bryans3c in #6656
  • [New Rules] Procfs Sycall Read & binfmt Configuration File Creation by @Aegrah in #6698
  • [New Rule] AWS GuardDuty Threat Intelligence Set Deleted by @bryans3c in #6659
  • [New Rule] AWS GetFederationToken Followed by Console Login via Federation Exchange by @bryans3c in #6660
  • [Tuning] Potential Web Shell ASPX File Creation by @Samirbous in #6700
  • [New] Potential Evasion via Boot Time Removal Tool by @Samirbous in #6690
  • [Tuning] Kubernetes Secrets List Across Cluster or Sensitive Namespaces by @Samirbous in #6692
  • [Rule Tuning] Azure RBAC Built-In Administrator Roles Assigned by @terrancedejesus in #6650
  • [Rule Tuning] Tune rule for inbound Java service exploitation via child process by @terrancedejesus in #6701
  • [Tuning] Elastic Defend Alert Followed by Telemetry Loss by @Samirbous in #6703
  • [Rule Deprecation] M365 Security Compliance Email Reported by User as Malware or Phish by @terrancedejesus in #6651
  • [New Rule] Claude Cowork VM Boot Image Tamper by @Mikaayenson in #6610
  • [Rule Tuning] Potential Privilege Escalation via SUID/SGID by @Aegrah in #6704
  • [Rule Tuning] Adding co-author in multiple rules by @litemars in #6547
  • [New] PaperCut CVE-2026-82078 and CVE-2026-81578 by @Samirbous in #6708
  • [Rule Tuning] Tune Network Rules for More Firewall Support by @eric-forte-elastic in #6702
  • Detect CVE-2026-65400 Screen Sharing exploitation via SSFileCopy helpers by @shashank-elastic in #6675
  • [Rule Tuning] Potential Masquerading as System32 DLL by @Aegrah in #6709
  • Monthly Manifest and Schema Refresh + investigation guides by @shashank-elastic in #6710
  • [New Rule] AWS Bedrock AgentCore Resource Created with IAM Execution Role by @bryans3c in #6697
  • [New Rule] AWS SES Full Access Policy Attached to IAM Entity by Unusual User by @bryans3c in #6657
  • [Rule Tuning] Windows SDB Rules by @w0rk3r in #6713
  • [New Rule] AWS SES Identity Verified Then Deleted by @bryans3c in #6658
  • Lock versions for releases: 8.19,9.3,9.4,9.5 by @github-actions[bot] in #6720
  • [Rule Tuning/Deprecation] Misc Windows Tuning by @w0rk3r in #6696
  • [Rule Tunings] Kubernetes/GKE Sensitive RBAC Change Followed by Workload Modification by @imays11 in #6699
  • [Tuning] Multiple Alerts Involving a User by @Samirbous in #6734
  • [New] Potential Entra ID PRT Extraction via BrowserCore by @Samirbous in #6705
  • [New Rule] AWS SES Enumeration via Long-Term Access Key by @bryans3c in #6717
  • [New Rule] AWS Backup Resource Enumeration via Long-Term Access Key by @bryans3c in #6718
  • [New Rule] AWS Service Quota Increase Requested by Rare Identity by @bryans3c in #6715
  • [New Rule] AWS Organizations Delegated Administrator Registered by @bryans3c in #6714
  • [New Rule] AWS S3 Bucket MFA Delete Disabled by @bryans3c in #6653
  • [New Rule] AWS Root Console Login Password Spraying by @bryans3c in #6723
  • [New Rule] AWS Security Hub Disabled by @bryans3c in #6719

Full Changelog: dev-v2.1.0...dev-v2.2.0

Contributors

Mikaayenson, w0rk3r, and 9 other contributors
Assets 2
Loading