Protections Artifacts
Elastic Security detection content for Endpoint
Install / Use
npx skills add elastic/protections-artifactsInstalls into whichever agent you are using.
README
Elastic Security prevents ransomware and malware, detects advanced threats, and arms responders with vital context. It’s free and open, ready for every endpoint.
Protections-Artifacts is the home of our detection logic (rules, yara, etc) for Elastic Security for endpoint. At Elastic, we believe that being open and transparent is critical for the success of us and our users. Check out our blog post if you are interested in additional background.
Directory
Below you will find the artifacts we have opened in this repository:
| Folder | Description |
| ------ | ----------- |
| behavior/ | EQL based malicious behavior rules |
| yara/ | Yara rules for malware protection |
| ransomware/ | Elastic ransomware protection artifact |
Questions? Problems? Suggestions?
If you would like you to provide feedback or contribute to this repository, please familiarize yourself with the applicable artifact’s readme and open an issue using one of the provided templates. We cannot accept pull requests at this time because this repository is automatically generated.
You can also reach us in our Slack Workspace or in the Security Discuss forum.
License
Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one or more contributor license agreements. Licensed under the Elastic License 2.0; you may not use these artifacts except in compliance with the Elastic License 2.0
Contributors must sign a Contributor License Agreement before contributing code to any Elastic repositories.
Related Skills
qqbot-channel
385.5kQQ channel management skill. Use qqbot_channel_api for explicit QQ channel-management requests; confirm write, delete, and bulk actions before calling authenticated QQ Open Platform endpoints.
docs-writer
106.4kAlways use this skill when the task involves writing, reviewing, or editing files in the `/docs` directory or any `.md` files in the repository.
cpp
40.5kGuide Cursor to write modern C++ and CMake code with clear structure, RAII, const-correctness, and safe error handling.
gamemaker-gml
40.5kGameMaker Language (GML) rules for scripts, objects, events, rooms, data structures, and performance-minded game code
