This documentation contains work-in-progress information for future Elastic Stack and Cloud releases. Use the version selector to view supported release docs. It also contains some Elastic Cloud serverless information. Check out our serverless docs for more details.
« Zoom Meeting with no Passcode Update v0.13.1 »
Elastic Docs ›Elastic Security Solution [8.16] ›Detections and alerts

Downloadable rule updates

edit

Downloadable rule updates

edit

This section lists all updates to prebuilt detection rules, made available with the Prebuilt Security Detection Rules integration in Fleet.

To update your installed rules to the latest versions, follow the instructions in Update Elastic prebuilt rules.

Update version Date New rules Updated rules Notes

8.7.1

15 Feb 2023

29

110

This release includes new rules for Windows and Linux endpoints. Additionally, significant rule tuning for Windows and Linux rules has been added for better rule efficacy. A Google Workspace promotional rule was added to promote security alerts from the Alert Center. Machine learning rules related to failed logins have been adjusted for better scoring results. Additional investigation guides have been added for Windows and Linux rules. A New Terms rule has been created to identify loaded Windows drivers not seen in the last 30 days. A guided onboarding rule has been created to assist new SIEM users with getting started.

8.6.1

15 Feb 2023

28

110

This release includes new rules for Windows and Linux endpoints. Additionally, significant rule tuning for Windows and Linux rules has been added for better rule efficacy. A Google Workspace promotional rule was added to promote security alerts from the Alert Center. Machine learning rules related to failed logins have been adjusted for better scoring results. Additional investigation guides have been added for Windows and Linux rules. A New Terms rule has been created to identify loaded Windows drivers not seen in the last 30 days.

8.5.1

14 Feb 2023

27

110

This release includes new rules for Windows and Linux endpoints. Additionally, significant rule tuning for Windows and Linux rules has been added for better rule efficacy. A Google Workspace promotional rule was added to promote security alerts from the Alert Center. Machine learning rules related to failed logins have been adjusted for better scoring results. Additional investigation guides have been added for Windows and Linux rules.

8.4.3

14 Feb 2023

27

110

This release includes new rules for Windows and Linux endpoints. Additionally, significant rule tuning for Windows and Linux rules has been added for better rule efficacy. A Google Workspace promotional rule was added to promote security alerts from the Alert Center. Machine learning rules related to failed logins have been adjusted for better scoring results. Additional investigation guides have been added for Windows and Linux rules.

8.4.2

24 Jan 2023

5

494

This release includes new rules for Windows regarding Microsoft Exchange interaction via Powershell. Additionally, significant rule tuning for Windows rules has been added for better rule efficacy. A new rule for multiple alerts with different ATT&CK tactics on a single host has also been included. A new rule for multiple alerts involving a single user has been added. Related integration tags and recommended versions have been added to endpoint rules. Bug fixes for OSQuery execution in rule investigation guides has been added.

8.3.4

24 Jan 2023

1

4

This release includes new rules for Windows regarding Microsoft Exchange interaction via PowerShell. A new rule for multiple alerts with different ATT&CK tactics on a single host has also been included. Additionally, a new rule for multiple alerts involving a single user has been added. This release also includes rule tuning for suspicious Windows Error Reporting child processes.

8.3.3

19 Jan 2023

17

500

This release includes new rules for Windows regarding Microsoft Exchange interaction via PowerShell. Additionally, significant rule tuning for Windows rules has been added for better rule efficacy. Related integration tags and recommended versions have been added to endpoint rules. Bug fixes for OSQuery execution in rule investigation guides has been added.

8.4.1

05 Dec 2022

20

298

This release includes new rules for Linux regarding reverse shells. Additionally, new windows rules have been added to supply coverage for credential access and access token manipulation. Specific Windows and Linux rules have been tuned to reduce false-positive signals.

8.3.2

06 Oct 2022

25

232

This release includes new rules for Linux, Windows, Google Workspace and Kubernetes. Also included are expanded investigation guides for Linux, Windows and macOS rules.

8.3.1

26 Aug 2022

0

113

This release includes new rules for Linux, Windows, Google Workspace and Kubernetes. Also included are expanded investigation and setup guides for Linux, Windows and macOS rules. Rule compatability for required event fields and related Fleet integrations has also been included.

8.2.1

24 Aug 2022

442

96

This release includes new rules for Windows, MacOS, Linux, Kubernetes, and considerable tuning efforts. Also included are expanded investion guides for Windows, Azure and AWS rules.

8.1.1

24 Jun 2022

14

159

This release includes new rules for Windows, MacOS, Linux and Kubernetes. Also included are expanded investigation guides for Windows rules. Additionally, this update includes new rules to help detect emerging threat BPFDoor. Updates to existing Windows rules were made to help detect exploitation attempts against CVE-2022-30190.

1.0.2

03 May 2022

42

341

This release includes new rules for MacOS regarding initial access and persistence coverage. New rules to detect shell evasion in Linux have also been added. Also included are expanded investigation guides for Windows rules as well as new rules for credential theft and Active Directory (AD). Additionally, this update includes new rules to help detect the emerging threat CVE-2022-0847 (Dirty Pipe)

0.14.3

13 Dec 2021

35

45

This release includes an update to an existing rule and adds a new rule to help detect CVE-2021-44228 (log4j2). Also included are updates and new rules for cloud integrations, windows, PowerShell, and others.

0.14.2

15 Oct 2021

18

89

This release includes rules covering Windows endpoints, as well as several third-party integrations — including rules contributed by the community.

0.14.1

08 Sep 2021

3

71

Included in this release is a rule to detect web shells, including ProxyShell activity.

0.13.3

22 Jul 2021

4

36

Included in this release is a rule for Windows Defender Exclusions, which has been used in recent campaigns, as well as a rule to resiliently detect parent PID spoofing.

0.13.2

07 Jul 2021

15

6

Included in this release are 3 new rules for the recently observed REvil activity as well as 4 new rules covering the recent PrintNightmare vulnerability.

0.13.1

21 Jun 2021

4

41

« Zoom Meeting with no Passcode Update v0.13.1 »