Detection rules

Identifies a burst of DHCP DISCOVER messages with an unusually high number of distinct client hardware addresses observed on the same capture segment within a short window. Attackers flood DISCOVER requests with spoofed or random MAC addresses to exhaust the DHCP lease pool, often as a precursor to deploying a rogue DHCP server.

T1498T1498.001

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Nov 4, 2026

LowElastic detection rules

Potential Low-Packet Port Scan Detected

This rule identifies a potential low-packet port scan. It detects final flows or firewall connection attempts from one internal source to many destination ports on one destination and transport, while requiring no more than two packets in each matching observation. Attackers can use low-packet scans to identify exposed services while minimizing completed connections. Low packet count is a scan heuristic and does not by itself prove that the traffic contains bare TCP SYN packets.

T1046T1595T1595.001

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Nov 4, 2026

LowElastic detection rules

Potential Network Scan Detected

This rule identifies a potential port scan from an internal IP address. A port scan is a method utilized by attackers to systematically scan a target system for open ports, allowing them to identify available services and potential vulnerabilities. By mapping out the open ports, attackers can gather critical information to plan and execute targeted attacks, gaining unauthorized access, compromising security, and potentially leading to data breaches, unauthorized control, or further exploitation

T1046T1595T1595.001

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Nov 4, 2026

LowElastic detection rules

Potential Network Sweep Detected

This rule identifies a potential network sweep. A network sweep is a method used by attackers to scan a target network, identifying active hosts, open ports, and available services to gather information on vulnerabilities and weaknesses. This reconnaissance helps them plan subsequent attacks and exploit potential entry points for unauthorized access, data theft, or other malicious activities.

T1018T1046T1595T1595.001

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Nov 4, 2026

HighElastic detection rules

Multiple DHCP Servers Responding to the Same Transaction

Identifies two or more distinct DHCP servers sending an OFFER or ACK for the same transaction ID (xid) within a short window, indicating a rogue DHCP server racing the legitimate one to win the client's handshake. This is the rogue-DHCP / adversary-in-the-middle precondition (T1557.003) and is operating-system agnostic, since it keys only on server behavior observed on the wire.

T1203T1557T1557.003

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Nov 4, 2026

MediumElastic detection rules

Cloud Instance Metadata Credential Path HTTP Request

Detects HTTP GET requests to the link-local instance metadata service (169.254.169.254) for cloud credential or token paths on AWS, GCP, or Azure. Adversaries and vulnerable workloads use scripts, shells, or application runtimes to read IAM role credentials or OAuth tokens from the metadata API. Requires the Network Packet Capture integration with HTTP decoding on ports 80 and 443 and process enrichment enabled so "process.*" fields are present.

T1552T1552.005

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Nov 4, 2026

Load more detections

Loading detection rules

Back to results

MediumElastic detection rules Elastic

GitHub IP Allow List Modified

Description

Detects changes to a GitHub organization IP allow list: creating, updating, or deleting allow-list entries, or enabling/disabling allow-list enforcement (including enforcement for installed GitHub Apps, the IdP-provided web allow list, and user-level enforcement). Adversaries with org-owner access may add or modify their own address, then enable enforcement, or weaken enforcement and remove legitimate entries to lock out administrators.

Detection logic

Its licence does not clear it for publishing here

Sunturai publishes a detection's own text where the licence it arrived under has been reviewed and permits it, and Elastic License 2.0 has not. The query as its source wrote it, its canonical form and the hash that pins this revision are in the workspace record.

Detection requirements

Platform: Containers ESXi IaaS Identity Provider Linux macOS Network Devices Office Suite SaaS Windows
The rule states no platform. This is derived from the 3 ATT&CK techniques it maps to.

Known benign triggers

Network changes, office IP rotations, or VPN egress updates performed by org owners. Confirm the entry value and that enforcement was not enabled unexpectedly.

MITRE ATT&CK mappings

0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.

Persistence

T1556Modify Authentication ProcessAlso under Defense Impairment and Credential Access.123 detections cover this technique

Defense Impairment

T1685Disable or Modify ToolsMapped as T1562, withdrawn by ATT&CK.283 detections cover this technique
T1686Disable or Modify System Firewall
- T1686.001Cloud FirewallMapped as T1562.007, withdrawn by ATT&CK.14 detections cover this technique

References

Links the source published beside this detection. Reference is the link the source wrote, unmodified. Class is decided by this catalogue from the host and path, not stated by the source. Cited by counts published detections citing the same resource, including this one, and the sources beneath it count the repositories this catalogue ingests, which is not the same as independent research.
Reference	Class	Cited by
docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-allowed-ip-addresses-for-your-organization	Unclassified	Only this detection cites it

From the source

At source: Open at source
Upstream identifier: aa11d33a-7c23-4e50-8d2e-f1c72803b61b
Tagged by the source as: Data Source: GithubData Source: GitHub Audit LogsDomain: CloudDomain: SaaSPlatform: GitHubResources: Investigation GuideRule Type: ESQLTactic: Defense EvasionTactic: PersistenceUse Case: Threat Detection

Licence

Published under: Elastic License 2.0Read the licence
Attribution: Required

Authorship

Written by: Elastic
Published: Nov 4, 2026
Version: 1