IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« rc.local/rc.common File Creation Update v8.11.1 »
Elastic Docs ›Elastic Security Solution [8.11] ›Detections and alerts

Downloadable rule updates

edit

Downloadable rule updates

edit

This section lists all updates to prebuilt detection rules, made available with the Prebuilt Security Detection Rules integration in Fleet.

To update your installed rules to the latest versions, follow the instructions in Update Elastic prebuilt rules.

For previous rule updates, please navigate to the last version.

Update version Date New rules Updated rules Notes

8.11.21

09 Jul 2024

9

13

This release includes new rules for Windows, Linux , AWS and Azure integration. New rules for Windows include detection for credential access and defense evasion. New rules for Linux include detection for persistence. New rules for AWS include detection for exfiltration, persistence and impact. New rules for Azure include detection for credential access. Additionally, significant rule tuning for Windows, Linux, AWS, Google Workplace and Microsoft 365 integration rules has been added for better rule efficacy and performance.

8.11.20

28 Jun 2024

12

15

This release includes new rules and tuned for Windows, Linux and AWS integration. New rules for Windows include detection for persistence and execution. New rules for Linux include detection for persistence and privilege escalation. New rules for AWS include detection for defense evasion. Additionally, significant rule tuning for Windows, Linux and AWS rules has been added for better rule efficacy and performance.

8.11.19

25 Jun 2024

6

54

This release includes new rules for Windows, Okta and AWS integration and tuned rules for Okta and AWS. New rules for Windows include detection for defense evasion, privilege escalation, and credential access. New rules for AWS include detection for persistence. New rules for Okta include detection for credential access. Additionally, significant rule tuning for Okta and AWS rules has been added for better rule efficacy and performance.

8.11.18

11 Jun 2024

19

29

This release includes new rules for Linux and AWS integration and tuned rules for Windows , Linux, AWS and Microsoft 365. New rules for Linux include detection for persistence. New rules for AWS include detection for execution, persistence, credential access, impact, exfiltration, privilege escalation and discovery. Additionally, significant rule tuning for Windows ,Linux and Microsoft 365 rules has been added for better rule efficacy and performance.

8.11.17

29 May 2024

4

123

This release includes new rules for Linux and AWS integration and tuned rules for Windows ,Linux and MacOS. New rules for Linux include detection for persistence. New rules for AWS include detection for lateral movement, defense evasion and discovery. Additionally, significant rule tuning for Windows ,Linux and MacOS rules has been added for better rule efficacy and performance.

8.11.16

15 May 2024

10

40

This release includes new rules for Windows and AWS integration and tuned rules for Windows and MacOS. New rules for Windows include detection for impact, execution, command and control and defense evasion. New rules for AWS include detection for persistence, defense evasion, exfiltration and credential access. Additionally, significant rule tuning for Windows and MacOS rules has been added for better rule efficacy and performance.

8.11.15

06 May 2024

0

0

This version bump is a result of an out of band update. No rules require an update to this version.

8.11.14

30 Apr 2024

2

2

This release includes new rules for Linux and Windows and tuned rules for Linux. New rules for Linux include detection for persistence. New rules for Windows include detection for privilege escalation. Additionally, significant rule tuning for Linux rules has been added for better rule efficacy and performance.

8.11.13

23 Apr 2024

11

110

This release includes new rules and tuned rules for Windows. New rules for Windows include detection for potential windows session hijacking via CcmExec. Additionally, significant rule tuning for Windows rules has been added for better rule efficacy and performance.

8.11.12

03 Apr 2024

8

231

This release includes new rules for Linux and Windows and tuned rules for Windows. Deprecated rules include Remote File Creation on a Sensitive Directory New rules for Linux include detection for persistence. New rules for Windows include detection for credential access, initial access, discovery and command and control. Additionally, significant rule tuning for Windows rules has been added for better rule efficacy and performance.

8.11.11

25 Mar 2024

5

549

This release includes new rules for Linux and Windows and tuned rules for Linux, Windows and macOS. New rules for Linux include detection for execution. New rules for Windows include detection for credential access. Additionally, significant rule tuning for Windows, Linux and macOS rules has been added for better rule efficacy and performance.

8.11.10

07 Mar 2024

9

7

This release includes significant rule tuning for Linux rules for better rule efficacy and performance.

8.11.9

23 Feb 2024

5

33

This release includes a new rule for Windows detection of suspicious execution from INET cache. Additionally, significant rule tuning for Windows and Linux rules has been added for better rule efficacy and performance.

8.11.8

08 Feb 2024

10

6

This release includes new and tuned rules for Linux and Windows. New rules for Linux include detection for discovery, persistence, privilege escalation and defense evasion. New rules for Windows include detection for Active Directory enumeration. Additionally, significant rule tuning for Windows, Linux and macOS rules has been added for better rule efficacy and performance.

8.11.7

25 Jan 2024

19

165

This release includes new rules for Windows, Linux, Containers and GitHub. New rules for Windows include detection for evasion via Windows Filtering Platform. Linux rules for endpoints include detection for kernel driver loading and buffer overflow exploitation. Container rules for Linux include detection for container breakout via modified release agent files. Several new GitHub rules have been added for detection of suspicious activity related to IP addresses, tokens and repositories. Additionally, significant rule tuning for Windows, Linux and macOS rules has been added for better rule efficacy and performance.

8.11.6

03 Jan 2024

1

64

This release includes a new Linux rule for detecting reverse TCP shells through child processes. Deprecated rules include Malicious Remote File Creation and Potential Process Herpaderping Attempt. Several Windows rules with EQL queries have been tuned for better rule efficacy and performance. An Okta rule for MFA deactivation has been tuned to reduce false positives. Rule content has been updated for several Windows, Linux and Okta rules to improve clarity and accuracy.

8.11.5

14 Dec 2023

7

35

This release includes new Windows, Linux and Okta rules. New rules for Windows include detection for processes created with duplicated tokens and interactive logons. Linux rules include detection for Out-of-Tree kernel module loading, persistence through Systemd-udevd and Kworker UID elevation. New rules for Okta include detection for stolen credentials being used to reset MFA and suspicious authentication events. Additionally, significant rule tuning for Windows, Linux and Okta rules has been added for better rule efficacy.

8.11.4

28 Nov 2023

11

68

This release includes new rules for Okta and Windows. New rules for Okta include anomalous authentication events into the admin console and 3rd party applications. The new rule for Windows checks for the first time one has seen a NewCredentials logon process. Additionally included is a tuning for an Okta rule detecting MFA bombing via push notifications.

8.11.3

14 Nov 2023

4

366

This release includes new machine learning and Linux rules. New rules for Linux include detection for suspicious network connections via Kworker, kernel ring buffer manipulation and driver loading. Additionally, significant rule tuning for Windows, Linux and macOS rules has been added for better rule efficacy.

8.11.2

24 Oct 2023

28

279

This release includes new rules for Windows and Linux. New rules for Windows include detection for image loading with invalid signatures. Linux rules include additional detection for suspicious Unix socket connections, privilege esvalation via cap_setuid and reverse shells. Several building block rules have been added for Linux and Windows regarding user entity behavior. Machine learning rules for Domain Generation Algorithms (DGA) and Lateral Movement Detection (LMD) analytic packages have been moved to prebuilt rules. Machine learning rules for Living-off-the-Land (LotL) Detection, and Data Exfiltration Detection (DED) analytic packages have been migrated to the prebuilt rules as well. Additionally, lucene queries using boolean logic have been updated to use uppercase operators.

8.11.1

14 Oct 2023

8

56

This release includes new rules for GitHub, Windows and Linux. New rules for GitHub include detection for organization wide applications and new repository owners. Linux rules include detection for CVE-2023-4911 and CVE-2023-38646 exploitation and reverse shells via background processes. Windows rules include detection for suspicious file extensions and user enumeration. Additionally, significant rule tuning for Windows PowerShell and Microsoft Build Engine rules has been added for better rule efficacy.
« rc.local/rc.common File Creation Update v8.11.1 »