Update v8.19.37
editUpdate v8.19.37
editThis section lists all updates associated with version 8.19.37 of the Fleet integration Prebuilt Security Detection Rules.
| Rule | Description | Status | Version |
|---|---|---|---|
Identifies a Python, Node.js, Bun, Deno, Ruby, PHP or Perl runtime, or a binary executing from a package install location, that opens a developer secret (SSH keys, package registry tokens, source control credentials or AI coding assistant credentials) and then connects to a cloud instance metadata service (IMDS) endpoint within one minute. This sequence matches credential stealers delivered through compromised packages, such as the malicious LiteLLM PyPI releases, while cloud provider credential files are excluded because legitimate cloud SDK credential chains read them before falling back to IMDS. |
new |
1 |
|
Detects creation or change of an AI coding-agent instruction file (agents.md or claude.md) in a user Downloads folder by a browser or an archive tool. A web page can save AGENTS.md or CLAUDE.md into Downloads without a click, and opening an archive can extract the same files there. Codex and Claude Code treat those files as trusted project instructions, which can lead them to rewrite their own configuration, install a package, or leak a login token. |
new |
1 |
|
Detects Visual Studio Code ("Code.exe" on Windows or "Code Helper" on macOS) spawning a shell or downloader whose command line contains an encoded command, a download cradle, or a reverse-shell pattern. Malicious IDE extensions use the editor process to run these commands after install. |
new |
1 |
|
Detects a single AWS principal invoking Amazon Bedrock models from three or more countries and three or more source IPs within the lookback window. LLMjacking operators often distribute stolen AWS credentials across proxies or resell them to multiple buyers, which produces inference traffic for one identity from many unrelated locations. |
new |
2 |
|
Identifies when the same AWS principal, from the same source IP, successfully calls EC2 "DescribeInstanceAttribute" for the "userData" attribute against more than 20 distinct instances within a 10-minute lookback. Instance user data often contains bootstrap scripts and hardcoded credentials, so retrieving it across many instances in a short window can indicate reconnaissance or credential harvesting. Known CSPM roles, AWS service invocations, and Terraform calls from major cloud and carrier networks are excluded. |
new |
2 |
|
Identifies three or more distinct AWS principals calling STS "GetCallerIdentity" from the same source IP and autonomous system within a 10-minute window. "GetCallerIdentity" returns the account and identity behind a credential and requires no permissions, so a burst of different non-role identities from one external address is a common credential-validation and account-enumeration step. Assumed roles, Vault OIDC users, and calls from major cloud and carrier networks are excluded. |
new |
2 |
|
Microsoft Foundry Keys or Connection Secrets Accessed by New Principal |
Identifies the first time in seven days that a high-privilege Azure principal lists or regenerates the API keys of a Microsoft Foundry (Azure AI Services) account, or reads the stored secrets of a Foundry account or project connection. Account keys grant direct inference access to every model deployment on the account and bypass Entra ID conditional access, and connection secrets hold credentials for downstream services such as Azure OpenAI, storage, and search. A compromised identity retrieving these keys is a common first step in LLMjacking and in pivoting from a Foundry project to the data it is connected to. |
new |
1 |
Azure Key Vault Multi-Vault Secret Retrieval Burst by Application |
Identifies a burst of successful Azure Key Vault secret retrievals by the same principal and application across multiple vaults. Adversaries with compromised application credentials may collect stored secrets at scale to access additional services or move laterally. |
new |
1 |
Identifies the creation, modification, or deletion of a content filter (RAI policy) or a custom blocklist on a Microsoft Foundry (Azure AI Services) account. Content filters decide which prompt and completion categories, jailbreak attempts, and protected material a model deployment blocks. An adversary with control of the account can weaken or remove these filters so that harmful prompts and outputs are no longer blocked or logged as filtered, which removes a guardrail and the detections that depend on its verdicts. |
new |
1 |
|
Identifies a successful non-interactive Microsoft Entra ID client sign-in for Microsoft Graph that carries managed, joined device context and reports an Edge client when the exact access token is subsequently used by a scripted client to query at least three distinct Microsoft Graph directory-enumeration paths. The rule correlates the Entra sign-in token identifier with Microsoft Graph activity rather than relying on the broader session identifier, which can be shared by legitimate application activity and multiple tokens. |
new |
1 |
|
Microsoft Graph Application Directory Reconnaissance with Denied Requests |
Identifies a Microsoft Graph application querying multiple directory collections and encountering access denials. Adversaries with compromised application credentials may enumerate users, groups, applications, service principals, directory roles, role assignments, and OAuth grants to identify privileged identities and opportunities for further access. |
new |
1 |
Identifies an IAM policy change on a Google Cloud project, folder, or organization that grants a Vertex AI role ( |
new |
1 |
|
First Time GCP Vertex AI Inference by Caller from Source ASN |
Detects the first time in 14 days that a Vertex AI caller (user or service account) runs model inference (GenerateContent, StreamGenerateContent, Predict, or RawPredict) from a source autonomous system (ASN). Stolen Google Cloud credentials, including exported service account keys and OAuth tokens, are used for LLMjacking from attacker infrastructure, which shows up as the victim identity calling models from a hosting provider, VPN, or residential proxy network it has never used before. |
new |
1 |
Detects enabling of private repository forking on a GitHub organization. Allowing forks of private repositories lets code leave the organization into personal forks, which is a common collection path after an org-owner compromise. |
new |
1 |
|
Detects creation or configuration change of a GitHub webhook. Attackers can add a hook to copy push, pull request, and workflow payloads (including secrets that land in those events) to an external URL. |
new |
2 |
|
Detects viewing, downloading, printing, generating, or using GitHub enterprise or organization SSO recovery codes. These codes bypass the IdP and are break-glass credentials. |
new |
1 |
|
Detects GitHub secret scanning creating an alert for a secret that it has determined is publicly leaked ("github.publicly_leaked == true"). Unlike a generic secret-scanning finding, a publicly leaked secret means GitHub observed the credential exposed outside the repository’s access boundary (for example in a public repository, gist, or other public location), so it should be treated as a confirmed credential compromise requiring immediate rotation rather than a low-signal scanner event. Gating on the public-leak flag also removes most of the noise from dummy strings and test fixtures, which are typically confined to private repositories and are not flagged as publicly leaked. |
new |
2 |
|
Detects GitHub Advanced Security being disabled for an enterprise, for all or new repositories in an organization, for existing or new user-namespace repositories, or for selected members via enterprise policy. Disabling GHAS removes secret scanning, code scanning, and related controls. |
new |
1 |
|
Detects when Dependabot alerts or security updates are disabled at the repository, organization, or enterprise level in GitHub. Adversaries may turn off Dependabot to reduce the chance that a malicious or vulnerable dependency they introduced is flagged; disabling it for an organization or enterprise removes this coverage across many repositories at once. |
new |
1 |
|
Detects changes to a GitHub organization IP allow list: creating, updating, or deleting allow-list entries, or enabling/disabling allow-list enforcement (including enforcement for installed GitHub Apps, the IdP-provided web allow list, and user-level enforcement). Adversaries with org-owner access may add or modify their own address, then enable enforcement, or weaken enforcement and remove legitimate entries to lock out administrators. |
new |
1 |
|
Detects when the two-factor authentication (2FA) requirement is disabled for a GitHub organization or enterprise. Removing the requirement downgrades every member in scope to password-only authentication and allows new members to be added without 2FA. Following an account takeover, an adversary may disable the requirement to preserve password-based access, reduce friction for enrolling attacker-controlled accounts, and lower the organization’s overall account-takeover resistance, making this a high-impact identity-control change. |
new |
1 |
|
Detects when OAuth App access restrictions are disabled for a GitHub organization. With restrictions enabled, only owner-approved OAuth Apps can access organization data; once disabled, any OAuth App that a member authorizes gains access without owner review. Following an account takeover, an adversary may disable restrictions and then authorize a malicious or attacker-controlled OAuth App to establish token-based persistence and exfiltrate repository data, making this a high-impact change to the organization’s third-party access controls. |
new |
1 |
|
Detects when automatic approval of fine-grained personal access token (PAT) requests is enabled for a GitHub organization. With auto-approval off, an owner must review and approve each fine-grained PAT before it can access organization resources; once enabled, members' PAT requests gain access without that review, removing a key control over programmatic access. Following an account takeover, an adversary with owner access may enable auto-approval to quietly provision long-lived, organization-scoped tokens for persistence and data access, making this a high-impact change to the organization’s programmatic-access controls. |
new |
1 |
|
Detects when SAML single sign-on (SSO) is disabled for a GitHub enterprise or organization. SAML SSO delegates authentication to an external identity provider (IdP) and lets administrators enforce IdP-side controls such as MFA, conditional access, and centralized deprovisioning. Disabling it removes those controls and allows members to authenticate with GitHub credentials alone. Following an account takeover, an adversary may disable SSO to evade IdP-enforced access policies and maintain access that survives IdP-side session revocation and deprovisioning, making this a high-impact identity-control change. |
new |
1 |
|
Detects bypass of GitHub secret scanning push protection, approval of a bypass request, or disabling push protection at enterprise, organization, or repository scope. This is separate from turning secret scanning off. Bypass means a detected secret was allowed into the repository — the pattern used after tj-actions and similar CI secret-dump attacks. |
new |
1 |
|
Detects creation or deletion of a GitHub SSH certificate authority (CA), or disabling the requirement that members use SSH certificates, for an organization or enterprise. A CA lets an org issue short-lived SSH certificates and optionally require them in place of personal SSH keys, centralizing and time-bounding Git access. Destroying the CA or dropping the requirement makes ordinary unmanaged SSH keys acceptable again. Following an account takeover, an adversary may make these changes to authenticate with keys the organization does not manage and evade certificate-based access control, making this a high-impact change to Git access controls. |
new |
1 |
|
Detects a burst of failed GitHub API requests (HTTP 4xx/5xx) recorded as |
new |
1 |
|
Detects a burst of GitHub |
new |
1 |
|
Detects ChatGPT Enterprise user messages that combine two or more common jailbreak techniques: overriding prior or system instructions, switching the assistant into an unrestricted persona or mode (for example DAN or developer mode), asking it to operate without safety restrictions or filters, or asking it to reveal its system prompt. Jailbreak prompts stack these techniques to talk the model out of its safety policy, and a user doing so in a managed workspace may be attempting to generate prohibited content or to probe the workspace’s controls. Requiring more than one technique keeps documents that merely quote a single jailbreak phrase from alerting. |
new |
1 |
|
This rule detects potentially dangerous commands spawned by the GitHub Actions Runner.Worker process or by shell interpreters launched via a runner entrypoint script on self-hosted runner machines. Adversaries who gain the ability to modify or trigger workflows in a linked GitHub repository can execute arbitrary commands on the runner host. This behavior may indicate malicious or unexpected workflow activity, including code execution, reconnaissance, credential harvesting, or network exfiltration initiated through a compromised repository or unauthorized workflow. |
update |
6 |
|
Potential Destructive AWS CLI Command Executed by GenAI Agent |
Identifies a cloud CLI command that destroys infrastructure or identities, such as terminating EC2 instances, removing S3 buckets, or deleting IAM users, when it is spawned by a GenAI coding agent directly or through the agent’s shell wrapper. A compromised or prompt-injected agent can be steered into wiping the developer’s environment and cloud account using the credentials it already holds, as seen in the malicious Amazon Q Developer for VS Code v1.84.0 release (AWS-2025-015). |
update |
3 |
This rule detects a distinctive PHP out-of-memory fatal error associated with PHP2Shell exploitation attempts. The combination of an allowed-memory-size exhaustion and the location "Unknown on line 0" is produced before normal application execution and is an indicator of attempts to exploit PHP memory-safety vulnerabilities, including CVE-2026-109618 and CVE-2026-109619. The rule can detect unsuccessful as well as successful attempts and does not, by itself, confirm remote code execution. |
update |
2 |
|
Identifies when a service has assumed a role in AWS Security Token Service (STS). Services can assume a role to obtain temporary credentials and access AWS resources. Adversaries can use this technique for credential access and privilege escalation. This is a New Terms rule that identifies when a service assumes a role in AWS Security Token Service (STS) to obtain temporary credentials and access AWS resources. While often legitimate, adversaries may use this technique for unauthorized access, privilege escalation, or lateral movement within an AWS environment. |
update |
218 |
|
Identifies deletion of Azure diagnostic settings for a resource group that has not had this operation in the prior 7 days. Diagnostic settings send platform logs and metrics to Log Analytics, Event Hubs, or storage; removing them blinds monitoring and detection. This rule uses an ES |
QL first-seen (new terms) approach keyed on the resource group so groups that constantly churn logging configuration are suppressed after the first occurrence, while a newly seen group still alerts. |
update |
|
112 |
Detects a burst of Azure AD Graph (graph.windows.net) directory enumeration by a single identity, keyed on the internal API version that ROADrecon hardcodes ( |
update |
|
4 |
Identifies Azure resource group deletions by a principal that has not performed this operation in the prior 7 days. Deletion of a resource group is permanent and removes all resources in the group. This rule uses an ES |
QL first-seen (new terms) approach keyed on the acting principal so routine infrastructure-as-code teardown is suppressed after the first occurrence, while still surfacing first-time or unusual identities performing the delete. |
|
update |
112 |
Detects rare non-interactive sign-ins where an Entra ID client application authenticates on behalf of a principal user using an application (client) ID that is not commonly associated with that user’s historical sign-in behavior. Adversaries with stolen credentials or OAuth tokens may abuse Entra ID–managed or first-party client IDs to perform on-behalf-of (OBO) authentication, blending into legitimate cloud traffic while avoiding traditional interactive sign-in flows. This technique is commonly observed in OAuth phishing, token theft, and access broker operations, and may precede lateral movement, persistence, or data access via Microsoft Graph or other cloud resources. The rule uses a New Terms approach to identify first-seen combinations of the UPN and Client ID within a defined history window, helping surface unexpected client usage that may indicate compromised identities, malicious automation, or unauthorized application impersonation. |
|
update |
12 |
Machine Learning Detected a DNS Request With a High DGA Probability Score |
A supervised machine learning model has identified a DNS question name with a high probability of sourcing from a Domain Generation Algorithm (DGA), which could indicate command and control network activity. |
update |
11 |
Machine Learning Detected a DNS Request Predicted to be a DGA Domain |
A supervised machine learning model has identified a DNS question name that is predicted to be the result of a Domain Generation Algorithm (DGA), which could indicate command and control network activity. |
update |
11 |
This rule detects protected branch setting changes on a GitHub repository originating from a user agent not previously seen performing protected branch changes in the last 7 days. Branch protection rules enforce workflows and requirements before a contributor can push changes to a branch. Unauthorized changes could be used to lower your organization’s security posture and leave you exposed for future attacks. Both push-time enforcement events ( |
|
update |
213 |
Detects when a user authorizes a GitHub OAuth application. Stolen OAuth grants persist after password changes until revoked and can clone or ZIP private repositories. This is not a GitHub App installation (integration_installation.create). |
|
update |
2 |
Persistence via a Hidden Plist Filename via macOS Security Events |
Identifies the registration of a launch agent or launch daemon whose property list (plist) filename begins with a dot, using launch item registration messages collected by the macOS Security Events integration. An adversary may establish persistence by installing a launch agent or daemon that executes at login or boot; plist files with filenames starting with a dot are hidden from default directory listings and are particularly suspicious. |
update |
6 |
Launch Item Registration with Suspicious Executable Path via macOS Security Events |
Identifies the registration of a launch agent or launch daemon whose target executable resides in a temporary or user-writable location, using launch item registration messages collected by the macOS Security Events integration. An adversary may establish persistence with a launch agent or daemon that runs a program staged in a world-writable or temporary directory, which is uncommon for legitimate software. |
update |
4 |
Excessive Sudo Authentication Failures via macOS Security Events |
Identifies a high number of failed sudo password attempts on a macOS host within a short time window, using sudo messages collected by the Authentication data stream of the macOS Security Events integration. Repeated sudo authentication failures may indicate an adversary with access to a low-privileged account attempting to guess an administrator password to escalate privileges. |
update |
4 |
Detects |
|
update |
2 |
Detects a shell search under |
|
update |
2 |
Detects creation of a local ESXi account. A new account is a separate login that remains after the session that created it. It has no rights until a role is assigned, and it is the first step toward a persistent login on the host. |
|
update |
2 |
This rule detects when a base64 decoded payload is piped to an interpreter on Linux systems. Adversaries may use base64 encoding to obfuscate data and pipe it to an interpreter to execute malicious code. This technique may be used to evade detection by host- or network-based security controls. |
|
update |
13 |
Identifies a high volume of |
|
update |
8 |
Identifies the creation of a hidden launch agent or daemon property list file. An adversary may establish persistence by installing a new launch agent or daemon which executes at login. Hidden plist files with filenames starting with a dot are particularly suspicious. |
|
update |
4 |
Identifies the creation or modification of the login window property list (plist). Adversaries may modify plist files to run a program during system boot or user login for persistence. |
|
update |
115 |
Identifies when a child process is spawned by the screensaver engine process, which is consistent with an attacker’s malicious payload being executed after the screensaver activated on the endpoint. An adversary can maintain persistence on a macOS endpoint by creating a malicious screensaver (.saver) file and configuring the screensaver plist file to execute code each time the screensaver is activated. |
|
update |
113 |
Identifies when a screensaver plist file is modified by an unexpected process. An adversary can maintain persistence on a macOS endpoint by creating a malicious screensaver (.saver) file and configuring the screensaver plist file to execute code each time the screensaver is activated. |
|
update |
115 |
Identifies the creation of a launch agent or daemon property list file containing abnormal or suspicious values. An adversary may establish persistence by installing a new launch agent or daemon which executes at login. This rule looks for plist files created in LaunchAgents/LaunchDaemons directories with paths commonly used by malware. |
|
update |
5 |
Privilege Escalation via Parallels Appliance Extract Argument Injection |
Identifies the Parallels Desktop root dispatcher (prl_disp_service) spawning tar/bsdtar with more arguments than its fixed extract command uses. The dispatcher always runs a 5-token command (tar -xf <archive> -C <dir>), so any additional arguments indicate an attacker-controlled folder name injecting extra tar flags. On macOS these flags let tar read or write attacker-chosen paths or execute an external program as root, resulting in local privilege escalation (CVE-2026-90894, Parallels Desktop < 27.0.0). |
update |
3 |
Identifies users being added to the admin group. This could be an indication of privilege escalation activity. |
|
update |
8 |
Detects HTTP GET requests to the link-local instance metadata service (169.254.169.254) for cloud credential or token paths on AWS, GCP, or Azure. Adversaries and vulnerable workloads use scripts, shells, or application runtimes to read IAM role credentials or OAuth tokens from the metadata API. Requires the Network Packet Capture integration with HTTP decoding on ports 80 and 443 and process enrichment enabled so "process.*" fields are present. |
|
update |
3 |
This rule identifies a potential network sweep. A network sweep is a method used by attackers to scan a target network, identifying active hosts, open ports, and available services to gather information on vulnerabilities and weaknesses. This reconnaissance helps them plan subsequent attacks and exploit potential entry points for unauthorized access, data theft, or other malicious activities. This rule defines a threshold-based approach to detect multiple connection attempts from a single host to numerous destination hosts over commonly used network services. |
|
update |
17 |
This rule identifies a potential port scan from an internal IP address. A port scan is a method utilized by attackers to systematically scan a target system for open ports, allowing them to identify available services and potential vulnerabilities. By mapping out the open ports, attackers can gather critical information to plan and execute targeted attacks, gaining unauthorized access, compromising security, and potentially leading to data breaches, unauthorized control, or further exploitation of the targeted system. This rule defines a threshold-based approach to detect connection attempts from a single internal source to a wide range of destination ports on a single destination. |
|
update |
18 |
This rule identifies a potential low-packet port scan. It detects final flows or firewall connection attempts from one internal source to many destination ports on one destination and transport, while requiring no more than two packets in each matching observation. Attackers can use low-packet scans to identify exposed services while minimizing completed connections. Low packet count is a scan heuristic and does not by itself prove that the traffic contains bare TCP SYN packets. |
|
update |
17 |
Detects changes to registry persistence keys that are not commonly used or modified by legitimate programs. This could be an indication of an adversary’s attempt to persist in a stealthy manner. |
|
update |
220 |
Identifies run key or startup key registry modifications. In order to survive reboots and other system interrupts, attackers will modify run keys within the registry or leverage startup folder items as a form of persistence. |