Skip to content

Elastic detection rules

Named by 2 kept items in this workspace.

Search every workspace for Elastic detection rules. It matches the name as written, so it can find other things that share it.

The items that name it 2

  • 0xMohammedHassan/morphkatz
    repo2026-05-07

    signature/detection content referenced as a byte-pattern detection type MorphKatz can defeat

  • Today I learned: binfmt_misc
    writeup2025-10-30It is written here as Elastic detection-rules (privilege_escalation_potential_suid_sgid_exploitation.toml).

    detection rule authored by Ruben Groenewoud (Elastic) intended to flag SUID/SGID exploitation; noted to NOT trigger against this binfmt_misc technique because chfn itself is never executed

All technologies in this workspace.