Pepe Berba

When deployed, `RaccineSettings` produces a dangling `Form1` window even without interaction

Lastpass Pishlet and dump_lastpass

17

Made a LastPass phishlet [(blog post)](https://pberba.github.io/security/2020/05/28/lastpass-phishing/) It was simpler to just grab the encrypted vault than hijacking the session, so I just grabbed some of the body of some of...

[FR] Expand `CUSTOM_RULES_DIR` to support user-relative paths

1

### Repository Feature None ### Problem Description Currently the `CUSTOM_RULES_DIR` environment variable only accepts an absolute paths. ### Desired Solution Modify https://github.com/elastic/detection-rules/blob/5d69eb19badf1af854b3e5cdb9445f214b733ead/detection_rules/config.py#L230 to ``` path = Path(CUSTOM_RULES_DIR).expanduser() / "_config.yaml" ```...

[Bug] TOML string outputs are not properly escaped

2

### Describe the Bug When the triple double quotes are used to output raw strings is used, the TOML is not checked for escaped characters and the rendered output is...

Update README for the installation of kibana and kql packages

2

# Pull Request *Issue link(s)*: ## Summary - What I changed Updated `Getting started` section to the correct way to install the `kibana` and `kql` packages from the repository. Using...

[FR] Support for actions in the CLI

3

### Repository Feature Detections-as-Code (DaC) - (primarily custom rule management) ### Problem Description I'm trying to use the structure described in [managing custom rules](https://github.com/elastic/detection-rules/blob/5d69eb19badf1af854b3e5cdb9445f214b733ead/docs-dev/custom-rules-management.md#understanding-the-structure) they don't seem to be used...

[Bug] GenericLoader incorrectly flags name collisions across different resource types

1

### Describe the Bug The names of the generic loader are checked for uniqueness. This can cause collisions for `actions` and exceptions` that share the same name. https://github.com/elastic/detection-rules/blob/66a0b6b97c47957e5019d681943f4ff8ed3470ac/detection_rules/generic_loader.py#L110-L111 ### To...