Prebuilt rule catalog

Browse Elastic's full library of prebuilt detection rules, organized by MITRE ATT&CK tactic. Each rule includes the detection technique, rule type, severity, and a link to the full rule source on GitHub.

Use this catalog to:

• Assess coverage: See which tactics and techniques have prebuilt detection rules available.
• Find rules by threat: Jump to a specific tactic to find rules matching your threat model.
• Understand rule types: Identify which rule engine (EQL, ES|QL, threshold, ML, and others) each rule uses, and link out to the rule source for full query logic, investigation notes, and false positive guidance.

To install these rules in your environment, refer to Install prebuilt rules. To understand the MITRE ATT&CK coverage your installed rules provide, refer to MITRE ATT&CK coverage.

Rules detecting techniques adversaries use to gain a first foothold in your environment, such as phishing, exploiting public-facing applications, and abusing valid accounts.

Rules detecting techniques adversaries use to run malicious code, including command-line interpreters, scripting, and exploitation of native OS utilities.

Rules detecting techniques adversaries use to maintain access across restarts and credential changes, such as scheduled tasks, startup items, and registry modifications.

Rules detecting techniques adversaries use to gain higher-level permissions, including exploitation of system vulnerabilities, access token manipulation, and elevation mechanism abuse.

Rules detecting techniques adversaries use to avoid detection, including disabling security tools, obfuscating code, tampering with logs, and abusing trusted processes.