Downloadable rule updates

8.5.8

29 Jun 2023

4

8

This release includes new Threat Indicator rules for IP addresses, domains, URLs, file hashes and Windows registry keys. Additionally, Windows rules for PowerShell abuse have been tuned for better rule efficacy.

8.5.7

28 Jun 2023

6

778

This release includes new Linux rules for detecting additional privilege escalation and enumeration techniques. Additionally, a new cross-platform rule for detecting command-and-control to Google Drive has been added. All rule tags have been adjusted to key value pairs for better rule searching and filtering in the Kibana UI. All network rules have been adjusted to query the network packet capture data indices. Rule tuning for Windows and Linux rules has been added for better rule efficacy.

8.5.6

14 Jun 2023

0

4

This release includes rule tuning for Windows rules for better rule efficacy. Rules tuned include WMI lateral movement, PowerShell Engine ImageLoad and unusual files created from alternate data streams.

8.5.5

01 Jun 2023

1

34

This release includes a new Linux rule for SSH brute force detection. Additionally, new investigation guides for Google Workspace and Windows rules have been added. Rule tuning for Linux, Google Workspace and Windows rules have been added for better rule efficacy.

8.5.4

18 May 2023

6

45

This release includes new rules for Linux and a new rule for Windows. New rules for Linux include detection for ransomware, credential dumping and web server exploitation. A rule to detect commonly abused remote administration tools on Windows has also been added. Additionally, significant rule tuning for Windows rules has been added for better rule efficacy.

8.5.3

27 Apr 2023

9

14

This release includes new rules for Windows, Linux, Google Workspace and ESXI. Additionally, significant rule tuning for Windows, Linux and Google Workspace has been added for better rule efficacy. Detection logic for Linux shell breakouts, Windows process injection and credential access has been improved. A Google Workspace rule has been added to detect potential phishing with Google Apps Script. Several ESXI rules have been added to detect discovery commands, timestomping and suspicious processes.

8.5.2

12 Apr 2023

10

565

This release includes new rules for Windows, Linux and Google Workspace. Additionally, significant rule tuning for Windows and Linux rules has been added for better rule efficacy. New Google Workspace rules leveraging the token (OAuth) data stream were added. Additional investigation guides for Windows rules have also been added to this release. A new rule for detecting cryptominers on Linux has also been included.

8.5.1

14 Feb 2023

27

110

This release includes new rules for Windows and Linux endpoints. Additionally, significant rule tuning for Windows and Linux rules has been added for better rule efficacy. A Google Workspace promotional rule was added to promote security alerts from the Alert Center. Machine learning rules related to failed logins have been adjusted for better scoring results. Additional investigation guides have been added for Windows and Linux rules.

8.4.3

14 Feb 2023

27

110

This release includes new rules for Windows and Linux endpoints. Additionally, significant rule tuning for Windows and Linux rules has been added for better rule efficacy. A Google Workspace promotional rule was added to promote security alerts from the Alert Center. Machine learning rules related to failed logins have been adjusted for better scoring results. Additional investigation guides have been added for Windows and Linux rules.

8.4.2

24 Jan 2023

5

494

This release includes new rules for Windows regarding Microsoft Exchange interaction via Powershell. Additionally, significant rule tuning for Windows rules has been added for better rule efficacy. A new rule for multiple alerts with different ATT&CK tactics on a single host has also been included. A new rule for multiple alerts involving a single user has been added. Related integration tags and recommended versions have been added to endpoint rules. Bug fixes for OSQuery execution in rule investigation guides has been added.

8.3.4

24 Jan 2023

1

4

This release includes new rules for Windows regarding Microsoft Exchange interaction via PowerShell. A new rule for multiple alerts with different ATT&CK tactics on a single host has also been included. Additionally, a new rule for multiple alerts involving a single user has been added. This release also includes rule tuning for suspicious Windows Error Reporting child processes.

8.3.3

19 Jan 2023

17

500

This release includes new rules for Windows regarding Microsoft Exchange interaction via PowerShell. Additionally, significant rule tuning for Windows rules has been added for better rule efficacy. Related integration tags and recommended versions have been added to endpoint rules. Bug fixes for OSQuery execution in rule investigation guides has been added.

8.4.1

05 Dec 2022

20

298

This release includes new rules for Linux regarding reverse shells. Additionally, new windows rules have been added to supply coverage for credential access and access token manipulation. Specific Windows and Linux rules have been tuned to reduce false-positive signals.

8.3.2

06 Oct 2022

25

232

This release includes new rules for Linux, Windows, Google Workspace and Kubernetes. Also included are expanded investigation guides for Linux, Windows and macOS rules.

8.3.1

26 Aug 2022

0

113

This release includes new rules for Linux, Windows, Google Workspace and Kubernetes. Also included are expanded investigation and setup guides for Linux, Windows and macOS rules. Rule compatability for required event fields and related Fleet integrations has also been included.

8.2.1

24 Aug 2022

442

96

This release includes new rules for Windows, MacOS, Linux, Kubernetes, and considerable tuning efforts. Also included are expanded investion guides for Windows, Azure and AWS rules.

8.1.1

24 Jun 2022

14

159

This release includes new rules for Windows, MacOS, Linux and Kubernetes. Also included are expanded investigation guides for Windows rules. Additionally, this update includes new rules to help detect emerging threat BPFDoor. Updates to existing Windows rules were made to help detect exploitation attempts against CVE-2022-30190.

1.0.2

03 May 2022

42

341

This release includes new rules for MacOS regarding initial access and persistence coverage. New rules to detect shell evasion in Linux have also been added. Also included are expanded investigation guides for Windows rules as well as new rules for credential theft and Active Directory (AD). Additionally, this update includes new rules to help detect the emerging threat CVE-2022-0847 (Dirty Pipe)

0.14.3

13 Dec 2021

35

45

This release includes an update to an existing rule and adds a new rule to help detect CVE-2021-44228 (log4j2). Also included are updates and new rules for cloud integrations, windows, PowerShell, and others.

0.14.2

15 Oct 2021

18

89

This release includes rules covering Windows endpoints, as well as several third-party integrations — including rules contributed by the community.

0.14.1

08 Sep 2021

3

71

Included in this release is a rule to detect web shells, including ProxyShell activity.

0.13.3

22 Jul 2021

4

36

Included in this release is a rule for Windows Defender Exclusions, which has been used in recent campaigns, as well as a rule to resiliently detect parent PID spoofing.

0.13.2

07 Jul 2021

15

6

Included in this release are 3 new rules for the recently observed REvil activity as well as 4 new rules covering the recent PrintNightmare vulnerability.

0.13.1

21 Jun 2021

4

41