IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« rc.local/rc.common File Creation Update v8.13.1 »
Elastic Docs ›Elastic Security Solution [8.13] ›Detections and alerts

Downloadable rule updates

edit

Downloadable rule updates

edit

This section lists all updates to prebuilt detection rules, made available with the Prebuilt Security Detection Rules integration in Fleet.

To update your installed rules to the latest versions, follow the instructions in Update Elastic prebuilt rules.

For previous rule updates, please navigate to the last version.

Update version Date New rules Updated rules Notes

8.13.22

11 Nov 2024

20

22

This release includes new rules for Windows, Linux, AWS, and Azure integration. New rules for Windows include detection for initial access. New rules for Linux include detection for defense evasion, command and control, impact, discovery, execution and exfiltration. New rules for AWS include detection for privilege escalation, exfiltration, execution, discovery and persistence. New rules for Azure include detection for credential access. Additionally, significant rule tuning for Windows and AWS rules has been added for better rule efficacy and performance.

8.13.21

28 Oct 2024

6

95

This release includes significant rule tuning for Linux, Amazon Bedrock and Okta rules for better rule efficacy and performance.

8.13.20

16 Oct 2024

1

185

This release includes a new rule for Windows credential access detection. Additionally, significant rule tuning for Windows, Sysmon, Microsoft Defender for Endpoint and SentinelOne rules has been added for better rule efficacy and performance.

8.13.19

10 Oct 2024

27

0

This release includes a new rule for Okta integration initial access detection. Additionally, significant rule tuning for ESQL queries has been added to include required metadata and achieve best practices for performance.

8.13.18

01 Oct 2024

6

184

This release includes new rules for Windows and Linux. New rules for Windows include detection for defense evasion. New rules for Linux include detection for CUPS Vulnerability exploitation including coverage for CVE-2024-47176, CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177 vulnerabilities. Additionally, significant rule tuning for Windows, AWS, AWS Bedrock and Microsoft 365 rules has been added for better rule efficacy and performance.

8.13.17

17 Sep 2024

22

6

This release includes new rules for Windows,Linux, MacOS, AWS Bedrock, Azure, Okta and Microsoft 365 integration. New rules for Windows include detection for privilege escalation, command and control, persistence, defense evasion and execution. New rules for Linux include detection for defense evasion, execution and credential access. New rules for MacOS include detection for privilege escalation. New rules for AWS Bedrock include detection for impact. New rules for Azure include detection for credential access. New Rules for Okta include detection for defense evasion. New Rules for Microsoft 365 include detection for initial access. Additionally, significant rule tuning for Windows , Linux and Microsoft 365 rules has been added for better rule efficacy and performance.

8.13.16

03 Sep 2024

10

5

This release includes new rules for Linux and AWS integration. New rules for Linux include detection for defense evasion and execution. New rules for AWS include detection for discovery, initial access, execution, and defense evasion. Additionally, significant rule tuning for Windows and MacOS rules has been added for better rule efficacy and performance.

8.13.15

21 Aug 2024

1

195

This release includes a new rule for Linux defense evasion detection. Additionally, significant rule tuning for Windows, Linux and AWS integration rules has been added for better rule efficacy and performance.

8.13.14

06 Aug 2024

7

44

This release includes new rules for Windows and AWS integration. New rules for Windows include detection for credential access and command and control. New rules for AWS include detection for execution, credential access, persistence and lateral movement. Additionally, significant rule tuning for Windows and Linux rules has been added for better rule efficacy and performance.

8.13.13

25 Jul 2024

14

72

This release includes new rules for Windows, Linux , and AWS integration. Deprecated rules include Suspicious File Changes Activity Detected. New rules for Windows include detection for lateral movement, credential access and defense evasion. New rules for Linux include detection for privilege escalation, execution, and persistence. New rules for AWS include detection for exfiltration, defense evasion and impact. Additionally, significant rule tuning for Windows, Linux, AWS, Google Workplace and Okta integration rules has been added for better rule efficacy and performance.

8.13.12

09 Jul 2024

10

15

This release includes new rules for Windows, Linux , AWS and Azure integration. New rules for Windows include detection for credential access and defense evasion. New rules for Linux include detection for persistence. New rules for AWS include detection for exfiltration, persistence and impact. New rules for Azure include detection for credential access. Additionally, significant rule tuning for Windows, Linux, AWS, Google Workplace and Microsoft 365 integration rules has been added for better rule efficacy and performance.

8.13.11

28 Jun 2024

12

28

This release includes new rules and tuned for Windows, Linux and AWS integration. New rules for Windows include detection for persistence and execution. New rules for Linux include detection for persistence and privilege escalation. New rules for AWS include detection for defense evasion. Additionally, significant rule tuning for Windows, Linux and AWS rules has been added for better rule efficacy and performance.

8.13.10

25 Jun 2024

10

55

This release includes new rules for Windows, Okta and AWS integration and tuned rules for Okta and AWS. New rules for Windows include detection for defense evasion, privilege escalation, and credential access. New rules for AWS include detection for persistence. New rules for Okta include detection for credential access. Additionally, significant rule tuning for Okta and AWS rules has been added for better rule efficacy and performance.

8.13.9

11 Jun 2024

24

29

This release includes new rules for Linux and AWS integration and tuned rules for Windows , Linux, AWS and Microsoft 365. New rules for Linux include detection for persistence. New rules for AWS include detection for execution, persistence, credential access, impact, exfiltration, privilege escalation and discovery. Additionally, significant rule tuning for Windows ,Linux and Microsoft 365 rules has been added for better rule efficacy and performance.

8.13.8

29 May 2024

4

123

This release includes new rules for Linux and AWS integration and tuned rules for Windows ,Linux and MacOS. New rules for Linux include detection for persistence. New rules for AWS include detection for lateral movement, defense evasion and discovery. Additionally, significant rule tuning for Windows ,Linux and MacOS rules has been added for better rule efficacy and performance.

8.13.7

15 May 2024

11

40

This release includes new rules for Windows and AWS integration and tuned rules for Windows and MacOS. New rules for Windows include detection for impact, execution, command and control and defense evasion. New rules for AWS include detection for persistence, defense evasion, exfiltration and credential access. Additionally, significant rule tuning for Windows and MacOS rules has been added for better rule efficacy and performance.

8.13.6

06 May 2024

6

0

This release includes new ESQL rules for AWS. New rules for AWS include detection for AWS S3 Bucket enumeration or brute force attempts. Additionally, this release includes new rules to detect threats against LLMs.

8.13.5

30 Apr 2024

2

2

This release includes new rules for Linux and Windows and tuned rules for Linux. New rules for Linux include detection for persistence. New rules for Windows include detection for privilege escalation. Additionally, significant rule tuning for Linux rules has been added for better rule efficacy and performance.

8.13.4

23 Apr 2024

11

110

This release includes new rules and tuned rules for Windows. New rules for Windows include detection for potential windows session hijacking via CcmExec. Additionally, significant rule tuning for Windows rules has been added for better rule efficacy and performance.

8.13.3

03 Apr 2024

8

238

This release includes new rules for Linux and Windows and tuned rules for Windows. Deprecated rules include Remote File Creation on a Sensitive Directory New rules for Linux include detection for persistence. New rules for Windows include detection for credential access, initial access, discovery and command and control. Additionally, significant rule tuning for Windows rules has been added for better rule efficacy and performance.

8.13.2

25 Mar 2024

5

549

This release includes new rules for Linux and Windows and tuned rules for Linux, Windows and macOS. New rules for Linux include detection for execution. New rules for Windows include detection for credential access. Additionally, significant rule tuning for Windows, Linux and macOS rules has been added for better rule efficacy and performance.

8.13.1

07 Mar 2024

9

7

This release includes significant rule tuning for Linux rules for better rule efficacy and performance.
« rc.local/rc.common File Creation Update v8.13.1 »