Skip to content

Commit b9b8e24

Browse files
github-actions[bot]github-actions[bot]
authored
Lock versions for releases: 8.19,9.0,9.1,9.2 (#5234)
1 parent 3c56a72 commit b9b8e24

File tree

3 files changed

+102
-47
lines changed

3 files changed

+102
-47
lines changed

‎detection_rules/etc/version.lock.json‎

Lines changed: 99 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -1021,9 +1021,9 @@
10211021
},
10221022
"183f3cd2-4cc6-44c0-917c-c5d29ecdcf74": {
10231023
"rule_name": "Simple HTTP Web Server Connection",
1024-
"sha256": "727923839de557236140f1a6cd53a8fecc509ccfd588c0f9201b3838ff5577b5",
1024+
"sha256": "15d0107c6bef8fe9ec0b4cd67d016ee63c23d7a545a81ceabb20663db9257e15",
10251025
"type": "eql",
1026-
"version": 4
1026+
"version": 5
10271027
},
10281028
"184dfe52-2999-42d9-b9d1-d1ca54495a61": {
10291029
"rule_name": "GCP Logging Sink Modification",
@@ -1207,9 +1207,9 @@
12071207
},
12081208
"1d485649-c486-4f1d-a99c-8d64795795ad": {
12091209
"rule_name": "Potential CVE-2025-32463 Sudo Chroot Execution Attempt",
1210-
"sha256": "ea72510a39315b359b31cda2a6a6372940ec6776a5da96685a7e6c5dd6862cba",
1210+
"sha256": "c074d6687b59f8e9a8ddf9fb262efa268ccb014e0e218c7d1f8ee218f6d627eb",
12111211
"type": "eql",
1212-
"version": 1
1212+
"version": 2
12131213
},
12141214
"1d4ca9c0-ff1e-11ee-91cc-f661ea17fbce": {
12151215
"rule_name": "AWS IAM Roles Anywhere Profile Creation",
@@ -1296,10 +1296,10 @@
12961296
"version": 115
12971297
},
12981298
"1f45720e-5ea8-11ef-90d2-f661ea17fbce": {
1299-
"rule_name": "AWS Signin Single Factor Console Login with Federated User",
1300-
"sha256": "d7dfefbed76f68577979701e4d7c33a6f48472d06569c268597a2d9553913692",
1301-
"type": "esql",
1302-
"version": 4
1299+
"rule_name": "AWS Sign-In Console Login with Federated User",
1300+
"sha256": "6e9e9d0016eeb4eb826db8de79279670dfa3a06d3fe5a5818eadb4a626d4e1d7",
1301+
"type": "query",
1302+
"version": 5
13031303
},
13041304
"1f460f12-a3cf-4105-9ebb-f788cc63f365": {
13051305
"rule_name": "Unusual Process Execution on WBEM Path",
@@ -2215,9 +2215,9 @@
22152215
},
22162216
"37cb6756-8892-4af3-a6bd-ddc56db0069d": {
22172217
"rule_name": "Disabling Lsa Protection via Registry Modification",
2218-
"sha256": "bcda7d22eba2491baa39d158b4381eec6d1df82b9d2b4c534e474a7f7c384b0b",
2218+
"sha256": "7aa1bf4249d928691c8853f7d53ad91afa3feb71d8bef5ddda0bf736c08c0d82",
22192219
"type": "eql",
2220-
"version": 2
2220+
"version": 3
22212221
},
22222222
"37cca4d4-92ab-4a33-a4f8-44a7a380ccda": {
22232223
"rule_name": "Spike in User Account Management Events",
@@ -2551,9 +2551,9 @@
25512551
},
25522552
"403ef0d3-8259-40c9-a5b6-d48354712e49": {
25532553
"rule_name": "Unusual Persistence via Services Registry",
2554-
"sha256": "3b86134e6a85714e4676aa01b2952e1a4936c55d61269d6858ab4364c23badd8",
2554+
"sha256": "53ec3c9de6cdade61cc0a64a9f0a1f4b8eb7587226bd349f521eee3cec24e2cc",
25552555
"type": "eql",
2556-
"version": 314
2556+
"version": 315
25572557
},
25582558
"40ddbcc8-6561-44d9-afc8-eefdbfe0cccd": {
25592559
"rule_name": "Suspicious Modprobe File Event",
@@ -2983,9 +2983,9 @@
29832983
},
29842984
"4d50a94f-2844-43fa-8395-6afbd5e1c5ef": {
29852985
"rule_name": "AWS Management Console Brute Force of Root User Identity",
2986-
"sha256": "46fed600c5e09c71e595ea8fba723e6da3eca531ac34ece084bb236a5755e711",
2986+
"sha256": "5eadaab1d0d86d7b1bb08cc7a0f7a80aa2c7cc383e6d35bfdf16542fb8252cc0",
29872987
"type": "threshold",
2988-
"version": 210
2988+
"version": 211
29892989
},
29902990
"4da13d6e-904f-4636-81d8-6ab14b4e6ae9": {
29912991
"rule_name": "Attempt to Disable Gatekeeper",
@@ -3337,9 +3337,9 @@
33373337
},
33383338
"57bfa0a9-37c0-44d6-b724-54bf16787492": {
33393339
"rule_name": "DNS Global Query Block List Modified or Disabled",
3340-
"sha256": "45f445274735262eed52517014047be86ee5efa40278bfde4ec07e09ad01577a",
3340+
"sha256": "06514c775695c6ffb15b50ee3e811ce692a4cdd882e2912e1a0ee65bbe346273",
33413341
"type": "eql",
3342-
"version": 207
3342+
"version": 208
33433343
},
33443344
"581add16-df76-42bb-af8e-c979bfb39a59": {
33453345
"rule_name": "Backup Deletion with Wbadmin",
@@ -4045,9 +4045,9 @@
40454045
},
40464046
"696015ef-718e-40ff-ac4a-cc2ba88dbeeb": {
40474047
"rule_name": "AWS IAM User Created Access Keys For Another User",
4048-
"sha256": "888041749b4414c84d0be90a29ada95f7951e481609ee11d11d96c9f959546dd",
4048+
"sha256": "7b39cd5eb1265b38b23ac4a4fd9eac4a5e4b88e749188c3227771a3ae3177289",
40494049
"type": "esql",
4050-
"version": 7
4050+
"version": 8
40514051
},
40524052
"699e9fdb-b77c-4c01-995c-1c15019b9c43": {
40534053
"rule_name": "Deprecated - Threat Intel Filebeat Module (v8.x) Indicator Match",
@@ -4068,10 +4068,10 @@
40684068
"version": 314
40694069
},
40704070
"69c420e8-6c9e-4d28-86c0-8a2be2d1e78c": {
4071-
"rule_name": "AWS IAM Password Recovery Requested",
4072-
"sha256": "a03120071cd58fed8c869795a758044717e224f1b2806cf58bc0e62c11612b04",
4071+
"rule_name": "AWS Sign-In Root Password Recovery Requested",
4072+
"sha256": "6a87957460149a2c3c9da1446442d537242d2a1338dd78452c1333f8ef267fdc",
40734073
"type": "query",
4074-
"version": 209
4074+
"version": 210
40754075
},
40764076
"6a058ed6-4e9f-49f3-8f8e-f32165ae7ebf": {
40774077
"rule_name": "Attempt to Disable Auditd Service",
@@ -5602,10 +5602,10 @@
56025602
"version": 213
56035603
},
56045604
"9563dace-5822-11f0-b1d3-f661ea17fbcd": {
5605-
"rule_name": "Suspicious Entra ID OAuth User Impersonation Scope Detected",
5606-
"sha256": "c6deeb78d65208cb064ab63b5fe16696308020973d3b7c228fc9c1f7aaea879e",
5605+
"rule_name": "Entra ID OAuth user_impersonation Scope for Unusual User and Client",
5606+
"sha256": "d85a04027a6cadbdbeda3a5e2788d97cad91e18a225baf00319a3c844dc3fe64",
56075607
"type": "new_terms",
5608-
"version": 2
5608+
"version": 3
56095609
},
56105610
"959a7353-1129-4aa7-9084-30746b256a70": {
56115611
"rule_name": "PowerShell Suspicious Script with Screenshot Capabilities",
@@ -5885,9 +5885,9 @@
58855885
},
58865886
"9aa4be8d-5828-417d-9f54-7cd304571b24": {
58875887
"rule_name": "AWS IAM AdministratorAccess Policy Attached to User",
5888-
"sha256": "fe18f1e29bcdc1dcebe1106d801d86351d22fd0e8f8cf68879814bf0a2cc1c96",
5889-
"type": "esql",
5890-
"version": 7
5888+
"sha256": "74186d700eaba184070afd0868707a68047dd64ddb8ceae3800367c60e212878",
5889+
"type": "eql",
5890+
"version": 8
58915891
},
58925892
"9b343b62-d173-4cfd-bd8b-e6379f964ca4": {
58935893
"rule_name": "GitHub Owner Role Granted To User",
@@ -5913,6 +5913,12 @@
59135913
"type": "eql",
59145914
"version": 8
59155915
},
5916+
"9c0f61fa-abf4-4b11-8d9d-5978c09182dd": {
5917+
"rule_name": "Potential Command Shell via NetCat",
5918+
"sha256": "8b7366396a7d5ebe64d336b843c68f81ab1cb913704133ec08cad70891f0de37",
5919+
"type": "eql",
5920+
"version": 1
5921+
},
59165922
"9c260313-c811-4ec8-ab89-8f6530e0246c": {
59175923
"rule_name": "Hosts File Modified",
59185924
"sha256": "390ab06dca3ca8c0b33b0af8548cfa728ba4c0ddd18d67a0435f3209a453f6da",
@@ -6117,6 +6123,18 @@
61176123
"type": "eql",
61186124
"version": 111
61196125
},
6126+
"a1b2c3d4-5e6f-7a8b-9c0d-1e2f3a4b5c6d": {
6127+
"rule_name": "Azure Storage Account Deletion by Unusual User",
6128+
"sha256": "a34ca5e23f6bdc0676fadb6a439653d4c17c1d7123a2399983f25d24ecabd5c6",
6129+
"type": "new_terms",
6130+
"version": 1
6131+
},
6132+
"a1b2c3d4-e5f6-7890-a1b2-c3d4e5f67890": {
6133+
"rule_name": "Entra ID Protection Admin Confirmed Compromise",
6134+
"sha256": "38404d75082d19283a1f7a678f193438c1eb1868ab1c395c3b5633bd6c8e89e4",
6135+
"type": "query",
6136+
"version": 1
6137+
},
61206138
"a1c2589e-0c8c-4ca8-9eb6-f83c4bbdbe8f": {
61216139
"rule_name": "Linux Group Creation",
61226140
"sha256": "117c5642bf9abb1c8ced8f0fb4f7ea6f53eeb0d759dcd7d7ef8d94931407ed0d",
@@ -6303,6 +6321,12 @@
63036321
"type": "eql",
63046322
"version": 8
63056323
},
6324+
"a8b3c4d5-e6f7-8901-a2b3-c4d5e6f78901": {
6325+
"rule_name": "Azure Storage Blob Retrieval via AzCopy",
6326+
"sha256": "630eb9459fc7c5632430c7f31e2e7b09b45d97301ab806d43a312588e54ee683",
6327+
"type": "new_terms",
6328+
"version": 1
6329+
},
63066330
"a8d35ca0-ad8d-48a9-9f6c-553622dca61a": {
63076331
"rule_name": "High Variance in RDP Session Duration",
63086332
"sha256": "ab11651cb3fb46c70c3fdbf4479abc32ea2fb7d096747443517a1d135615d72c",
@@ -6687,6 +6711,12 @@
66876711
"type": "eql",
66886712
"version": 212
66896713
},
6714+
"b2c3d4e5-6f7a-8b9c-0d1e-2f3a4b5c6d7e": {
6715+
"rule_name": "Azure Storage Account Deletions by User",
6716+
"sha256": "0f80a00629784a14aee160694167d10df069b573b26579e2bc65a08152b94be1",
6717+
"type": "threshold",
6718+
"version": 1
6719+
},
66906720
"b347b919-665f-4aac-b9e8-68369bf2340c": {
66916721
"rule_name": "Unusual Linux Username",
66926722
"sha256": "ebac0be3cc98660cdc22804d5fb5347f782deed7f06851e8d9774d2b80988cf1",
@@ -6785,9 +6815,9 @@
67856815
},
67866816
"b66b7e2b-d50a-49b9-a6fc-3a383baedc6b": {
67876817
"rule_name": "Potential Privilege Escalation via Service ImagePath Modification",
6788-
"sha256": "eccf507bc8d95b170c3c8fe97c0d64f5c18cbd98f12ad13d52942d956fd7fd65",
6818+
"sha256": "209df9ae546ce07831a4b3ba56aba23d6f88229516b869bf7b7b1d654f795f55",
67896819
"type": "eql",
6790-
"version": 106
6820+
"version": 107
67916821
},
67926822
"b6dce542-2b75-4ffb-b7d6-38787298ba9d": {
67936823
"rule_name": "Azure Event Hub Authorization Rule Created or Updated",
@@ -6837,6 +6867,12 @@
68376867
"type": "eql",
68386868
"version": 210
68396869
},
6870+
"b8c3e5d0-8a1a-11ef-9b4a-f661ea17fbce": {
6871+
"rule_name": "Azure Recovery Services Resource Deleted",
6872+
"sha256": "1b78e1a881f43c3177aead24fc927410356a5d006d1cda47e70d26a9e9641342",
6873+
"type": "query",
6874+
"version": 1
6875+
},
68406876
"b8f8da2d-a9dc-48c0-90e4-955c0aa1259a": {
68416877
"rule_name": "Kirbi File Creation",
68426878
"sha256": "f0425912b32267ad405c24d9e2fc4da797b6544d08646645eb230ade605c0b4e",
@@ -6952,10 +6988,10 @@
69526988
"version": 211
69536989
},
69546990
"bc0c6f0d-dab0-47a3-b135-0925f0a333bc": {
6955-
"rule_name": "AWS Root Login Without MFA",
6956-
"sha256": "519788e45f361c3cb6338fc81531cda4b6aa8e9179a53857eef300b9b554633e",
6991+
"rule_name": "Deprecated - AWS Root Login Without MFA",
6992+
"sha256": "1f43dead85d0d3544a5c39d1e599b0413d8338a3bd86555c4c1259946d0a1686",
69576993
"type": "query",
6958-
"version": 211
6994+
"version": 212
69596995
},
69606996
"bc0f2d83-32b8-4ae2-b0e6-6a45772e9331": {
69616997
"rule_name": "GCP Storage Bucket Deletion",
@@ -7121,15 +7157,15 @@
71217157
},
71227158
"c04be7e0-b0fc-11ef-a826-f661ea17fbce": {
71237159
"rule_name": "AWS IAM Login Profile Added for Root",
7124-
"sha256": "3b617425debc3763357899a4263aa9e971a933de176e492566d0fc6f1c69ba8b",
7125-
"type": "esql",
7126-
"version": 3
7160+
"sha256": "c5bbdc1ecd098d1662468fe725a7c06a09fbe0ba15cc114d30c6913b14c20b38",
7161+
"type": "eql",
7162+
"version": 4
71277163
},
71287164
"c07f7898-5dc3-11f0-9f27-f661ea17fbcd": {
71297165
"rule_name": "Excessive Secret or Key Retrieval from Azure Key Vault",
7130-
"sha256": "71490d9e8c07a97f2667d6114cb624765794bbb66594e75796631e71ba0b191d",
7166+
"sha256": "3042d4bb8ab097ead4fa72001cd04d2743f87611580ff1c9b8bcb407509522ff",
71317167
"type": "esql",
7132-
"version": 3
7168+
"version": 4
71337169
},
71347170
"c0b9dc99-c696-4779-b086-0d37dc2b3778": {
71357171
"rule_name": "Memory Dump File with Unusual Extension",
@@ -7167,6 +7203,12 @@
71677203
"type": "eql",
71687204
"version": 4
71697205
},
7206+
"c1a3e2f0-8a1b-11ef-9b4a-f661ea17fbce": {
7207+
"rule_name": "Azure Compute Restore Point Collection Deleted by Unusual User",
7208+
"sha256": "88df0fc3cd338a29ae8295259e9f0d1dadb41f0c776597e8de99f353aac0fa2c",
7209+
"type": "new_terms",
7210+
"version": 1
7211+
},
71707212
"c1a9ed70-d349-11ef-841c-f661ea17fbcd": {
71717213
"rule_name": "Unusual AWS S3 Object Encryption with SSE-C",
71727214
"sha256": "1fb0a155b09c230d21da5f67b1371127da7b21d7f20eeedf34c8835ccbd6825d",
@@ -8007,6 +8049,12 @@
80078049
"type": "eql",
80088050
"version": 1
80098051
},
8052+
"d8f4e3b0-8a1b-11ef-9b4a-f661ea17fbce": {
8053+
"rule_name": "Azure Compute Restore Point Collections Deleted",
8054+
"sha256": "ffb8ee8defb030d0393b9f49ecbd35b48e0c588a1fc7aa474c0ea9783cbb4084",
8055+
"type": "threshold",
8056+
"version": 1
8057+
},
80108058
"d8fc1cca-93ed-43c1-bbb6-c0dd3eff2958": {
80118059
"rule_name": "AWS IAM Deactivation of MFA Device",
80128060
"sha256": "e3aa8dd0f5cf3941fcbd532ba48689e04c30276c78f3c8eb76b4a025c1f0ed4a",
@@ -8183,9 +8231,9 @@
81838231
},
81848232
"dde13d58-bc39-4aa0-87fd-b4bdbf4591da": {
81858233
"rule_name": "AWS IAM AdministratorAccess Policy Attached to Role",
8186-
"sha256": "22beec2712ccc6324db5a12c0229a5dbf1dfa203f5f40cdc2b8252829c11635b",
8187-
"type": "esql",
8188-
"version": 6
8234+
"sha256": "b3ca27c45d2de7b202cc549993210a03f1957b463a3f9bbcefb64f7add983b2d",
8235+
"type": "eql",
8236+
"version": 7
81898237
},
81908238
"ddf26e25-3e30-42b2-92db-bde8eb82ad67": {
81918239
"rule_name": "File Creation in /var/log via Suspicious Process",
@@ -8249,9 +8297,9 @@
82498297
},
82508298
"df919b5e-a0f6-4fd8-8598-e3ce79299e3b": {
82518299
"rule_name": "AWS IAM AdministratorAccess Policy Attached to Group",
8252-
"sha256": "3425a710a5f13c4e30c9c4037a965992ccc0a30a688df68fece4052ac7458c30",
8253-
"type": "esql",
8254-
"version": 6
8300+
"sha256": "0ea7a9667e0f94a73639fcccf64290ba4166d4aec6157b99cee23d42147754b8",
8301+
"type": "eql",
8302+
"version": 7
82558303
},
82568304
"df959768-b0c9-4d45-988c-5606a2be8e5a": {
82578305
"rule_name": "Unusual Process Execution - Temp",
@@ -8369,9 +8417,9 @@
83698417
},
83708418
"e2a67480-3b79-403d-96e3-fdd2992c50ef": {
83718419
"rule_name": "AWS Management Console Root Login",
8372-
"sha256": "55a1881c70b22e2d80c9d0b37c8ec78fab97cdee6442c7362d75b9479ad0335a",
8420+
"sha256": "019e82bf0a7ce94d7eb9d5ef8c69792e65dcf4fed414132cf22f8f1bc105439c",
83738421
"type": "query",
8374-
"version": 211
8422+
"version": 212
83758423
},
83768424
"e2dc8f8c-5f16-42fa-b49e-0eb8057f7444": {
83778425
"rule_name": "System Network Connections Discovery",
@@ -9243,6 +9291,12 @@
92439291
"type": "query",
92449292
"version": 1
92459293
},
9294+
"f754e348-f36f-4510-8087-d7f29874cc12": {
9295+
"rule_name": "AWS Sign-In Token Created",
9296+
"sha256": "5a4040e73d23453205709b9e456464e7d162621cff2e1513ca9e81c7a3b97414",
9297+
"type": "query",
9298+
"version": 1
9299+
},
92469300
"f75f65cf-ed04-48df-a7ff-b02a8bfe636e": {
92479301
"rule_name": "System Hosts File Access",
92489302
"sha256": "95d21e6f12f573fcfe1c7b40679200ac326659d5bec0e2e78d7729d1967afa05",

‎docs-dev/ATT&CK-coverage.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,6 @@ coverage from the state of rules in the `main` branch.
7676
|[Elastic-detection-rules-tags-aws-secrets-manager](https://mitre-attack.github.io/attack-navigator/#layerURL=https%3A%2F%2Fgist.githubusercontent.com%2Ftradebot-elastic%2F0443cfb5016bed103f1940b2f336e45a%2Fraw%2FElastic-detection-rules-tags-aws-secrets-manager.json&leave_site_dialog=false&tabs=false)|
7777
|[Elastic-detection-rules-tags-aws-service-quotas](https://mitre-attack.github.io/attack-navigator/#layerURL=https%3A%2F%2Fgist.githubusercontent.com%2Ftradebot-elastic%2F0443cfb5016bed103f1940b2f336e45a%2Fraw%2FElastic-detection-rules-tags-aws-service-quotas.json&leave_site_dialog=false&tabs=false)|
7878
|[Elastic-detection-rules-tags-aws-sign-in](https://mitre-attack.github.io/attack-navigator/#layerURL=https%3A%2F%2Fgist.githubusercontent.com%2Ftradebot-elastic%2F0443cfb5016bed103f1940b2f336e45a%2Fraw%2FElastic-detection-rules-tags-aws-sign-in.json&leave_site_dialog=false&tabs=false)|
79-
|[Elastic-detection-rules-tags-aws-signin](https://mitre-attack.github.io/attack-navigator/#layerURL=https%3A%2F%2Fgist.githubusercontent.com%2Ftradebot-elastic%2F0443cfb5016bed103f1940b2f336e45a%2Fraw%2FElastic-detection-rules-tags-aws-signin.json&leave_site_dialog=false&tabs=false)|
8079
|[Elastic-detection-rules-tags-aws-sns](https://mitre-attack.github.io/attack-navigator/#layerURL=https%3A%2F%2Fgist.githubusercontent.com%2Ftradebot-elastic%2F0443cfb5016bed103f1940b2f336e45a%2Fraw%2FElastic-detection-rules-tags-aws-sns.json&leave_site_dialog=false&tabs=false)|
8180
|[Elastic-detection-rules-tags-aws-sqs](https://mitre-attack.github.io/attack-navigator/#layerURL=https%3A%2F%2Fgist.githubusercontent.com%2Ftradebot-elastic%2F0443cfb5016bed103f1940b2f336e45a%2Fraw%2FElastic-detection-rules-tags-aws-sqs.json&leave_site_dialog=false&tabs=false)|
8281
|[Elastic-detection-rules-tags-aws-ssm](https://mitre-attack.github.io/attack-navigator/#layerURL=https%3A%2F%2Fgist.githubusercontent.com%2Ftradebot-elastic%2F0443cfb5016bed103f1940b2f336e45a%2Fraw%2FElastic-detection-rules-tags-aws-ssm.json&leave_site_dialog=false&tabs=false)|
@@ -86,6 +85,7 @@ coverage from the state of rules in the `main` branch.
8685
|[Elastic-detection-rules-tags-azure-activity-logs](https://mitre-attack.github.io/attack-navigator/#layerURL=https%3A%2F%2Fgist.githubusercontent.com%2Ftradebot-elastic%2F0443cfb5016bed103f1940b2f336e45a%2Fraw%2FElastic-detection-rules-tags-azure-activity-logs.json&leave_site_dialog=false&tabs=false)|
8786
|[Elastic-detection-rules-tags-azure-key-vault](https://mitre-attack.github.io/attack-navigator/#layerURL=https%3A%2F%2Fgist.githubusercontent.com%2Ftradebot-elastic%2F0443cfb5016bed103f1940b2f336e45a%2Fraw%2FElastic-detection-rules-tags-azure-key-vault.json&leave_site_dialog=false&tabs=false)|
8887
|[Elastic-detection-rules-tags-azure-platform-logs](https://mitre-attack.github.io/attack-navigator/#layerURL=https%3A%2F%2Fgist.githubusercontent.com%2Ftradebot-elastic%2F0443cfb5016bed103f1940b2f336e45a%2Fraw%2FElastic-detection-rules-tags-azure-platform-logs.json&leave_site_dialog=false&tabs=false)|
88+
|[Elastic-detection-rules-tags-azure-storage](https://mitre-attack.github.io/attack-navigator/#layerURL=https%3A%2F%2Fgist.githubusercontent.com%2Ftradebot-elastic%2F0443cfb5016bed103f1940b2f336e45a%2Fraw%2FElastic-detection-rules-tags-azure-storage.json&leave_site_dialog=false&tabs=false)|
8989
|[Elastic-detection-rules-tags-azure](https://mitre-attack.github.io/attack-navigator/#layerURL=https%3A%2F%2Fgist.githubusercontent.com%2Ftradebot-elastic%2F0443cfb5016bed103f1940b2f336e45a%2Fraw%2FElastic-detection-rules-tags-azure.json&leave_site_dialog=false&tabs=false)|
9090
|[Elastic-detection-rules-tags-bbr](https://mitre-attack.github.io/attack-navigator/#layerURL=https%3A%2F%2Fgist.githubusercontent.com%2Ftradebot-elastic%2F0443cfb5016bed103f1940b2f336e45a%2Fraw%2FElastic-detection-rules-tags-bbr.json&leave_site_dialog=false&tabs=false)|
9191
|[Elastic-detection-rules-tags-bpfdoor](https://mitre-attack.github.io/attack-navigator/#layerURL=https%3A%2F%2Fgist.githubusercontent.com%2Ftradebot-elastic%2F0443cfb5016bed103f1940b2f336e45a%2Fraw%2FElastic-detection-rules-tags-bpfdoor.json&leave_site_dialog=false&tabs=false)|
@@ -110,6 +110,7 @@ coverage from the state of rules in the `main` branch.
110110
|[Elastic-detection-rules-tags-email](https://mitre-attack.github.io/attack-navigator/#layerURL=https%3A%2F%2Fgist.githubusercontent.com%2Ftradebot-elastic%2F0443cfb5016bed103f1940b2f336e45a%2Fraw%2FElastic-detection-rules-tags-email.json&leave_site_dialog=false&tabs=false)|
111111
|[Elastic-detection-rules-tags-endpoint](https://mitre-attack.github.io/attack-navigator/#layerURL=https%3A%2F%2Fgist.githubusercontent.com%2Ftradebot-elastic%2F0443cfb5016bed103f1940b2f336e45a%2Fraw%2FElastic-detection-rules-tags-endpoint.json&leave_site_dialog=false&tabs=false)|
112112
|[Elastic-detection-rules-tags-entra-audit-logs](https://mitre-attack.github.io/attack-navigator/#layerURL=https%3A%2F%2Fgist.githubusercontent.com%2Ftradebot-elastic%2F0443cfb5016bed103f1940b2f336e45a%2Fraw%2FElastic-detection-rules-tags-entra-audit-logs.json&leave_site_dialog=false&tabs=false)|
113+
|[Elastic-detection-rules-tags-entra-id-protection-logs](https://mitre-attack.github.io/attack-navigator/#layerURL=https%3A%2F%2Fgist.githubusercontent.com%2Ftradebot-elastic%2F0443cfb5016bed103f1940b2f336e45a%2Fraw%2FElastic-detection-rules-tags-entra-id-protection-logs.json&leave_site_dialog=false&tabs=false)|
113114
|[Elastic-detection-rules-tags-entra-id-sign-in-logs](https://mitre-attack.github.io/attack-navigator/#layerURL=https%3A%2F%2Fgist.githubusercontent.com%2Ftradebot-elastic%2F0443cfb5016bed103f1940b2f336e45a%2Fraw%2FElastic-detection-rules-tags-entra-id-sign-in-logs.json&leave_site_dialog=false&tabs=false)|
114115
|[Elastic-detection-rules-tags-entra-id-sign-in](https://mitre-attack.github.io/attack-navigator/#layerURL=https%3A%2F%2Fgist.githubusercontent.com%2Ftradebot-elastic%2F0443cfb5016bed103f1940b2f336e45a%2Fraw%2FElastic-detection-rules-tags-entra-id-sign-in.json&leave_site_dialog=false&tabs=false)|
115116
|[Elastic-detection-rules-tags-entra-id](https://mitre-attack.github.io/attack-navigator/#layerURL=https%3A%2F%2Fgist.githubusercontent.com%2Ftradebot-elastic%2F0443cfb5016bed103f1940b2f336e45a%2Fraw%2FElastic-detection-rules-tags-entra-id.json&leave_site_dialog=false&tabs=false)|

‎pyproject.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[project]
22
name = "detection_rules"
3-
version = "1.5.1"
3+
version = "1.5.2"
44
description = "Detection Rules is the home for rules used by Elastic Security. This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security’s Detection Engine."
55
readme = "README.md"
66
requires-python = ">=3.12"

0 commit comments

Comments
 (0)