Downloadable rule updates

8.9.15

23 Feb 2024

5

32

This release includes new rules for Windows including detection of suspicious execution from INET cache, potential business app masquerading, executions from removable media, XSL script using the Microsoft.XMLDOM COM interface and remote file execution via MSIEXEC. Additionally, significant rule tuning for Windows and Linux rules has been added for better rule efficacy and performance.

8.9.14

08 Feb 2024

10

6

This release includes new and tuned rules for Linux and Windows. New rules for Linux include detection for discovery, persistence, privilege escalation and defense evasion. New rules for Windows include detection for Active Directory enumeration. Additionally, significant rule tuning for Windows, Linux and macOS rules has been added for better rule efficacy and performance.

8.9.13

25 Jan 2024

10

163

This release includes new rules for Windows, Linux, Containers and GitHub. New rules for Windows include detection for evasion via Windows Filtering Platform. Linux rules for endpoints include detection for kernel driver loading and buffer overflow exploitation. Container rules for Linux include detection for container breakout via modified release agent files. Several new GitHub rules have been added for detection of suspicious activity related to IP addresses, tokens and repositories. Additionally, significant rule tuning for Windows, Linux and macOS rules has been added for better rule efficacy and performance.

8.9.12

03 Jan 2024

1

61

This release includes a new Linux rule for detecting reverse TCP shells through child processes. Deprecated rules include Malicious Remote File Creation and Potential Process Herpaderping Attempt. Several Windows rules with EQL queries have been tuned for better rule efficacy and performance. Rule content has been updated for several Windows and Linux rules to improve clarity and accuracy.

8.9.11

14 Dec 2023

6

33

This release includes new Windows and Linux rules. New rules for Windows include detection for processes created with duplicated tokens and interactive logons. Linux rules include detection for Out-of-Tree kernel module loading, persistence through Systemd-udevd and Kworker UID elevation. Additionally, significant rule tuning for Windows and Linux rules has been added for better rule efficacy.

8.9.10

28 Nov 2023

34

67

This release includes a new Windows and a new Okta rule. The new rule for Windows checks for the first time one has seen a NewCredentials logon process. The Okta rule is a detection for phishing using FastPass.

8.9.9

14 Nov 2023

2

366

This release includes new machine learning and Linux rules. New rules for Linux include detection for suspicious network connections via Kworker, kernel ring buffer manipulation and driver loading. Additionally, significant rule tuning for Windows, Linux and macOS rules has been added for better rule efficacy.

8.9.8

24 Oct 2023

28

279

This release includes new rules for Windows and Linux. New rules for Windows include detection for image loading with invalid signatures. Linux rules include additional detection for suspicious Unix socket connections, privilege esvalation via cap_setuid and reverse shells. Several building block rules have been added for Linux and Windows regarding user entity behavior. Machine learning rules for Domain Generation Algorithms (DGA) and Lateral Movement Detection (LMD) analytic packages have been moved to prebuilt rules. Machine learning rules for Living-off-the-Land (LotL) Detection, and Data Exfiltration Detection (DED) analytic packages have been migrated to the prebuilt rules as well. Additionally, lucene queries using boolean logic have been updated to use uppercase operators.

8.9.7

14 Oct 2023

21

56

This release includes new rules for GitHub, Windows and Linux. New rules for GitHub include detection for organization wide applications and new repository owners. Linux rules include detection for CVE-2023-4911 and CVE-2023-38646 exploitation and reverse shells via background processes. Windows rules include detection for suspicious file extensions and user enumeration. Additionally, significant rule tuning for Windows PowerShell and Microsoft Build Engine rules has been added for better rule efficacy.

8.9.6

18 Sep 2023

5

7

This release includes new rules for Windows, Linux and Github. Github rules have officially been added to the prebuilt rules package. New rules for Windows include additional detection for suspicious shorcut files, WMI execution and persistence via Office documents. Regarding, Linux include additional detection for reverse shells via UDP and Meterpreter. Windows rules have been tuned for better rule efficacy.

8.9.5

07 Sep 2023

14

505

This release includes new rules for Windows, Linux and macOS. New rules for Windows include additional detection for LOLBins, credential access and defense evasion. Regarding, Linux include additional detection for privilege escalation, user enumeration and anomalous binary execution. New detection for macOS includes trap signal execution, hidden files and suspicious process relationships. Additionally, significant rule tuning for Windows and Linux rules has been added for better rule efficacy.

8.9.4

17 Aug 2023

10

29

This release includes new Linux rules for detecting additional privilege escalation and enumeration techniques. Additionally, a Windows rule has been added to detection PowerShell script execution with Webcam access. The Suspicious Network Connection Attempt by Root Linux rule has been deprecated in favor of the new privilege escalation rules. Rule tuning for Windows and Linux rules has been added for better rule efficacy.

8.9.3

02 Aug 2023

7

62

This release includes new building block rules for Windows and Linux. Additionally, threat intel indicator rules have been deprecated in favor of new categorized indicator rules. Windows, Linux and Kubernetes rules have been tuned for better rule efficacy.

8.9.2

14 Jul 2023

20

28

This release includes new rules for Linux regarding reverse shells, credential access and reconnaissance. Additionally, Windows rules for PowerShell and WMI abuse have been tuned for better rule efficacy. Linux rule tuning included detection for shadow files, abnormal PID relationships and brute forcing attempts.

8.9.1

29 Jun 2023

4

8

This release includes new Threat Indicator rules for IP addresses, domains, URLs, file hashes and Windows registry keys. Additionally, Windows rules for PowerShell abuse have been tuned for better rule efficacy.