dev-v3.0.0

Note

This major version validates ES|QL rules offline with detection-rules-esql-py 0.1.0. Remote ES|QL validation is removed, including --esql-remote-validation. Rules are checked when they load, against the rule min_stack_version and local schemas, and are no longer posted to an Elasticsearch cluster. Queries that previously loaded because remote validation was skipped can now fail local syntax, schema, or type checks. DR_BYPASS_ESQL_KEEP_VALIDATION and DR_BYPASS_ESQL_METADATA_VALIDATION still skip only the KEEP and FROM metadata checks.

Changes

• [Rule Tuning] Mark-of-the-Web Removal by an Unusual Process (#6819) @w0rk3r
• [Rule Tuning] Temporarily Scheduled Task Creation (#6845) @tradebot-elastic
• [New] Potential ClickFix Command via Windows Run Dialog (#6902) @Samirbous
• [Tuning] Network Connection to OAST Domain via Script Interpreter (#6863) @Samirbous
• [Rule Tuning] Add Min Stack for Rules using MV_CONTAINS etc. (#6860) @eric-forte-elastic
• [Rule Tuning] Fix ES|QL comparisons on multivalued fields (#6854) @Mikaayenson
• [Rule Tuning] PANW Incomplete Data Exclusions (#6777) @eric-forte-elastic
• Suppress docs-builder autolink hint for generated rule pages (#6840) @Mpdreamz
• [Rule Tuning] AWS S3 Credential File Retrieved from Bucket (#6817) @bryans3c
• [Rule Tuning] Systemd Service Override Configuration File Created (#6813) @tradebot-elastic
• Lock versions for releases: 8.19,9.3,9.4,9.5 (#6805) @github-actions[bot]
• [Rule Tuning] Tune process.parent.(args|command_line) for CS and Security Logs (#6795) @w0rk3r
• [Rule Tuning] DNS Request to Suspicious Top Level Domain (#6759) @Aegrah
• [Rule Tuning] Elastic Defend and Network Security Alerts Correlation (#6793) @w0rk3r
• [New Rule] Linux Firewall Rule Creation or Modification (#6774) @Aegrah
• [New Rule] Potential Fileless Execution via Unusual memfd Create Call (#6748) @Aegrah
• Add Mising Investigation Guides (#6790) @shashank-elastic
• [Tuning] M365 Teams Rogue Help Desk Chat Created (#6730) @Samirbous
• [Rule Tuning] Potential Linux Hack Tool Launched (#6762) @eric-forte-elastic
• [Tuning] Web Server Cloud Metadata SSRF Request (#6737) @Samirbous
• [Tuning] AWS Lateral Movement from Kubernetes SA via AssumeRoleWithWebIdentity (#6740) @Samirbous
• [Tuning] Protected Storage Service Access via SMB (#6738) @Samirbous
• [Tuning] AWS AssumeRoleWithWebIdentity from Kubernetes SA and External ASN (#6739) @Samirbous
• [Tuning] Remote Management Access Launch After MSI Install (#6767) @Samirbous
• [New Rule] Azure AKS Pod Exec Potential Reverse Shell (#6585) @terrancedejesus
• [New Rule] Newly Seen Commonly Abused Network Scanner (#6760) @w0rk3r
• [New Rules] RMM Installation via Internet-Originated MSI (#6633) @w0rk3r
• Add macOS Software Signing cert to exclusions for macOS 27 (#6766) @shashank-elastic
• [Rule Tuning] M365 Identity User Brute Force Attempted (#6761) @eric-forte-elastic
• [CI] Serialize backport pushes and retry on tip races (#6772) @Mikaayenson
• [New Rule] First Seen Network Flow Exporter (#6689) @eric-forte-elastic
• [Rule Tuning] Network Activity to a Suspicious Top Level Domain (#6764) @eric-forte-elastic
• [New Rule] Azure WireServer Abuse Related Detections (#6668) @terrancedejesus
• [New Rule] Potential Fileless Execution via O_TMPFILE (#6743) @Aegrah
• [New Rules] Three Linux File-Related Web Server Rules (#6742) @Aegrah
• [Rule FN Tuning] System V Init Script Created (#6758) @Aegrah
• [New Rule] Potential Data Exfiltration via AzCopy or Azure Storage Explorer (#6755) @terrancedejesus
• [Rule Tuning] Suricata and Elastic Defend Network Correlation (#6763) @eric-forte-elastic
• [Tuning] Update Alert Suppression for Network Rules (#6731) @eric-forte-elastic
• [New Rule] Entra ID Windows Hello for Business Key-Borrowing Detections (#6624) @terrancedejesus
• [New Rule] Entra ID device-bound PRT cookie replay from unusual IP (#6706) @terrancedejesus
• Expand Clickfix Coverage (#6735) @shashank-elastic
• [New Rule] AWS SES Account Email Sending Enabled (#6716) @bryans3c

🚀 Features

• [FR] Offline ES|QL validation via detection-rules-esql-py (#6499) @Mikaayenson
• Lock versions for releases: 8.19,9.3,9.4,9.5 (#6843) @github-actions[bot]
• [Tags] Add XDR/SIEM taxonomy tags (phase 1) (#6839) @Mikaayenson
• Update dependency pre-commit to v4.6.2 (#6771) @elastic-renovate-prod[bot]
• [CI] Fix invalid YAML in backport concurrency group (#6770) @Mikaayenson
• [CI] Support Merge Queues 🚀 (#6670) @Mikaayenson
• [FR] Memoize the integration schema (#6592) @eric-forte-elastic
• [FR] Deduplicate query validation targets (#6593) @eric-forte-elastic
• [FR] Reduce rebuilding and re-hashing the rules package (#6594) @eric-forte-elastic
• [FR] Support ES|QL sub queries (#6665) @eric-forte-elastic

🐛 Bug Fixes

• fix: sanitize slash-containing ATT&CK navigator layer filenames (#6841) @Mikaayenson
• [Bug] Test Remote Rules Using Old Fields (#6794) @eric-forte-elastic
• fix(tests): allow same-day rule tunings without updated_date bump (#6681) @Mikaayenson
• [Bug] Fix unit tests that relied on shared cache state after #6594 (#6769) @eric-forte-elastic
• [Bug] Missing Non ECS fields for ES|QL Rules post 6491 merge (#6765) @eric-forte-elastic
• [Bug] ECS Checks Overly Broad in Certain Integrations (#6491) @eric-forte-elastic
• [DaC] [Bug] KeyError when loading a production rule whose min_stack_version is above the package version (#6753) @eric-forte-elastic
• [Bug] ES|QL Remote Validation: field_extract() on flattened types causes ambiguous schema mapping error (#6727) @eric-forte-elastic
• [Rule Tuning] M365 OneDrive/SharePoint Excessive File Downloads - fix file.size mapping conflict (#6754) @terrancedejesus
• [Bug] [DaC] Fix: validate threat_query against threat_index schemas (#6721) @eric-forte-elastic

🛠 Internal Changes

• [FR] Offline ES|QL validation via detection-rules-esql-py (#6499) @Mikaayenson
• [New Rules] Add Anthropic compliance audit detection rules (#6264) @Mikaayenson
• [Docs] Restore rule tag taxonomy guidance dropped in #6839 (#6849) @Mikaayenson
• [Tags] Add XDR/SIEM taxonomy tags (phase 1) (#6839) @Mikaayenson
• fix: publish only all and platforms ATT&CK navigator gist layers (#6842) @Mikaayenson
• fix: sanitize slash-containing ATT&CK navigator layer filenames (#6841) @Mikaayenson
• [Tags] Add rule profiling tags: Recommended, Noise, Performance, Threat (#6832) @Samirbous
• Fix code checks after dependancy updates (#6800) @shashank-elastic
• [New Rules] Add SSH brute force rules for the macOS Security Events integration (#6747) @shashank-elastic
• chore: consolidate open Renovate dependency updates (v2.2.15) (#6797) @Mikaayenson
• [Bug] Test Remote Rules Using Old Fields (#6794) @eric-forte-elastic
• Fix KQL Optimisation failures in Unit Tests (#6791) @shashank-elastic
• fix(tests): allow same-day rule tunings without updated_date bump (#6681) @Mikaayenson
• [FR] Memoize the integration schema (#6592) @eric-forte-elastic
• [FR] Deduplicate query validation targets (#6593) @eric-forte-elastic
• [Bug] Fix unit tests that relied on shared cache state after #6594 (#6769) @eric-forte-elastic
• [FR] Reduce rebuilding and re-hashing the rules package (#6594) @eric-forte-elastic
• [Bug] Missing Non ECS fields for ES|QL Rules post 6491 merge (#6765) @eric-forte-elastic
• [Bug] ECS Checks Overly Broad in Certain Integrations (#6491) @eric-forte-elastic
• [DaC] [Bug] KeyError when loading a production rule whose min_stack_version is above the package version (#6753) @eric-forte-elastic
• [Bug] ES|QL Remote Validation: field_extract() on flattened types causes ambiguous schema mapping error (#6727) @eric-forte-elastic
• [Bug] [DaC] Fix: validate threat_query against threat_index schemas (#6721) @eric-forte-elastic
• [FR] Support ES|QL sub queries (#6665) @eric-forte-elastic

🔍 Hunting Updates

• [FR] Offline ES|QL validation via detection-rules-esql-py (#6499) @Mikaayenson
• Update credential_access_rapid_reset_password_requests_for_different_… (#6828) @Mikaayenson
• [Rule/Hunt Tuning] ESQL Query Validation Discovered Issues (#6823) @Mikaayenson
• [New Hunt] Java_Ghost Threat Actor Infrastructure and Identity Markers (#6711) @bryans3c