8.12.9

23 Apr 2024

11

110

This release includes new rules and tuned rules for Windows. New rules for Windows include detection for potential windows session hijacking via CcmExec. Additionally, significant rule tuning for Windows rules has been added for better rule efficacy and performance.

8.12.8

03 Apr 2024

8

238

This release includes new rules for Linux and Windows and tuned rules for Windows. Deprecated rules include Remote File Creation on a Sensitive Directory New rules for Linux include detection for persistence. New rules for Windows include detection for credential access, initial access, discovery and command and control. Additionally, significant rule tuning for Windows rules has been added for better rule efficacy and performance.

8.12.7

25 Mar 2024

5

549

This release includes new rules for Linux and Windows and tuned rules for Linux, Windows and macOS. New rules for Linux include detection for execution. New rules for Windows include detection for credential access. Additionally, significant rule tuning for Windows, Linux and macOS rules has been added for better rule efficacy and performance.

8.12.6

07 Mar 2024

9

7

This release includes significant rule tuning for Linux rules for better rule efficacy and performance.

8.12.5

23 Feb 2024

5

33

This release includes a new rule for Windows detection of suspicious execution from INET cache. Additionally, significant rule tuning for Windows and Linux rules has been added for better rule efficacy and performance.

8.12.4

08 Feb 2024

10

6

This release includes new and tuned rules for Linux and Windows. New rules for Linux include detection for discovery, persistence, privilege escalation and defense evasion. New rules for Windows include detection for Active Directory enumeration. Additionally, significant rule tuning for Windows, Linux and macOS rules has been added for better rule efficacy and performance.

8.12.3

25 Jan 2024

19

165

This release includes new rules for Windows, Linux, Containers and GitHub. New rules for Windows include detection for evasion via Windows Filtering Platform. Linux rules for endpoints include detection for kernel driver loading and buffer overflow exploitation. Container rules for Linux include detection for container breakout via modified release agent files. Several new GitHub rules have been added for detection of suspicious activity related to IP addresses, tokens and repositories. Additionally, significant rule tuning for Windows, Linux and macOS rules has been added for better rule efficacy and performance.

8.12.2

03 Jan 2024

1

64

This release includes a new Linux rule for detecting reverse TCP shells through child processes. Deprecated rules include Malicious Remote File Creation and Potential Process Herpaderping Attempt. Several Windows rules with EQL queries have been tuned for better rule efficacy and performance. An Okta rule for MFA deactivation has been tuned to reduce false positives. Rule content has been updated for several Windows, Linux and Okta rules to improve clarity and accuracy.

8.12.1

14 Dec 2023

7

35

This release includes new Windows, Linux and Okta rules. New rules for Windows include detection for processes created with duplicated tokens and interactive logons. Linux rules include detection for Out-of-Tree kernel module loading, persistence through Systemd-udevd and Kworker UID elevation. New rules for Okta include detection for stolen credentials being used to reset MFA and suspicious authentication events. Additionally, significant rule tuning for Windows, Linux and Okta rules has been added for better rule efficacy.