8.4.2

24 Jan 2023

5

494

This release includes new rules for Windows regarding Microsoft Exchange interaction via Powershell. Additionally, significant rule tuning for Windows rules has been added for better rule efficacy. A new rule for multiple alerts with different ATT&CK tactics on a single host has also been included. A new rule for multiple alerts involving a single user has been added. Related integration tags and recommended versions have been added to endpoint rules. Bug fixes for OSQuery execution in rule investigation guides has been added.

8.3.4

24 Jan 2023

1

4

This release includes new rules for Windows regarding Microsoft Exchange interaction via PowerShell. A new rule for multiple alerts with different ATT&CK tactics on a single host has also been included. Additionally, a new rule for multiple alerts involving a single user has been added. This release also includes rule tuning for suspicious Windows Error Reporting child processes.

8.3.3

19 Jan 2023

17

500

This release includes new rules for Windows regarding Microsoft Exchange interaction via PowerShell. Additionally, significant rule tuning for Windows rules has been added for better rule efficacy. Related integration tags and recommended versions have been added to endpoint rules. Bug fixes for OSQuery execution in rule investigation guides has been added.

8.4.1

05 Dec 2022

20

298

This release includes new rules for Linux regarding reverse shells. Additionally, new windows rules have been added to supply coverage for credential access and access token manipulation. Specific Windows and Linux rules have been tuned to reduce false-positive signals.

8.3.2

06 Oct 2022

25

232

This release includes new rules for Linux, Windows, Google Workspace and Kubernetes. Also included are expanded investigation guides for Linux, Windows and macOS rules.

8.3.1

26 Aug 2022

0

113

This release includes new rules for Linux, Windows, Google Workspace and Kubernetes. Also included are expanded investigation and setup guides for Linux, Windows and macOS rules. Rule compatability for required event fields and related Fleet integrations has also been included.

8.2.1

24 Aug 2022

442

96

This release includes new rules for Windows, MacOS, Linux, Kubernetes, and considerable tuning efforts. Also included are expanded investion guides for Windows, Azure and AWS rules.

8.1.1

24 Jun 2022

14

159

This release includes new rules for Windows, MacOS, Linux and Kubernetes. Also included are expanded investigation guides for Windows rules. Additionally, this update includes new rules to help detect emerging threat BPFDoor. Updates to existing Windows rules were made to help detect exploitation attempts against CVE-2022-30190.

1.0.2

03 May 2022

42

341

This release includes new rules for MacOS regarding initial access and persistence coverage. New rules to detect shell evasion in Linux have also been added. Also included are expanded investigation guides for Windows rules as well as new rules for credential theft and Active Directory (AD). Additionally, this update includes new rules to help detect the emerging threat CVE-2022-0847 (Dirty Pipe)

0.14.3

13 Dec 2021

35

45

This release includes an update to an existing rule and adds a new rule to help detect CVE-2021-44228 (log4j2). Also included are updates and new rules for cloud integrations, windows, PowerShell, and others.

0.14.2

15 Oct 2021

18

89

This release includes rules covering Windows endpoints, as well as several third-party integrations — including rules contributed by the community.

0.14.1

08 Sep 2021

3

71

Included in this release is a rule to detect web shells, including ProxyShell activity.

0.13.3

22 Jul 2021

4

36

Included in this release is a rule for Windows Defender Exclusions, which has been used in recent campaigns, as well as a rule to resiliently detect parent PID spoofing.

0.13.2

07 Jul 2021

15

6

Included in this release are 3 new rules for the recently observed REvil activity as well as 4 new rules covering the recent PrintNightmare vulnerability.

0.13.1

21 Jun 2021

4

41