Skip to main content

​
Threat Intelligence Release 351

Release Notes | October 2026 Important Communications Updates to correlation rules, field extraction, and event parsing across multiple vendors.
  • Changes may affect filters or correlations that reference vendor specific fields
  • Improvements to detection accuracy and false positive reduction may affect correlation behavior for Microsoft Windows, Office 365, and Cloudflare environments
New Detections
  • Detection for admin operations performed in Microsoft Azure Active Directory adding members to roles scoped over restrictive management assignment
  • Detection for Microsoft Office 365 Azure Active Directory admin operations with multiple permission changes
  • Detection for password spray activity using Windows NxLog events
  • Detection for suspicious Windows MSHTA spawning curl or PowerShell to retrieve a Windows Installer (MSI) file
  • Detection for suspicious execution in Microsoft Defender Advanced Threat Protection
  • Detection for suspicious ScreenConnect top-level domains
  • Detection for TeamCity exploitation based on SentinelOne events
  • Detection for impossible travel activity in Google Workspace
  • Detection for anomalous sign-in properties in Microsoft Outlook
Detection and Correlation Improvements
  • Improved field extraction to parse account names and file paths for Cmd or PowerShell Execution with Comments detections
  • Improved rule logic to parse reporting device hostnames to OTX alarms
  • Reduced false positives for Windows Scheduled Job Created detections by excluding Custom Field 29 and BingWallpaper
  • Reduced false positives for Microsoft Edge remote file download detections by tuning legitimate headless rendering activity
  • Improved field extraction to parse source process parent, source process parent command line, and source process grandparent command line for CrowdStrike detections
  • Improved detection logic for CrowdStrike alarms by adding in-progress event status
  • Improved detection logic for possible Impacket SecretDump remote activity
  • Improved detection logic for Kerberos logon to multiple accounts
  • Improved accuracy for PowerShell Execution of Hoaxshell detections by adding a check for command line positioning
  • Improved field extraction to parse source process parent and source process parent command line for PowerShell Execution of Encoded Command detections
  • Improved field extraction and reduced false positives for Cloudflare Enterprise detections by parsing firewall actions and removing blocked traffic
  • Reduced false positives for Avanan Email Security potential phishing email detections by excluding graymail
Plugin Improvements
  • Improved parsing for Sophos XG Firewall syslog events
  • Improved field extraction to parse sensitive information type names for Microsoft Office 365 Exchange logs
  • Added parsing support for additional fields in VMware API syslog events
  • Improved parsing for Microsoft Azure Network Security Group logs
  • Added parsing support for SAP HANA syslog events
  • Improved parsing for Amazon Web Services RDS PostgreSQL logs
  • Improved decoding for Docker logs
  • Added a new regular expression to improve parsing for VeloCloud logs
  • Added parsing support for Dell SonicWall NSa 2650 Common Event Format logs
  • Improved parsing for UILA uObserve syslog events
  • Improved parsing for Google G Suite Audit events
  • Improved parsing for Okta API logs
  • Improved field extraction to parse command line data for Microsoft Defender events
  • Added parsing support for Cyberint
  • Improved parsing for Netskope Common Event Format logs
  • Added parsing support for Radware Cloud Web Application Firewall syslog events
Fixes
  • Fixed parsing issues for VMware ESXi generic syslog events
  • Fixed parsing issues for Juniper EX Series generic syslog events
  • Fixed parsing issues for Amazon Web Services RDS MySQL syslog events
  • Fixed parsing issues for Kaspersky Security Center logs
  • Resolved an issue causing blank event names in Trellix Endpoint Security logs

​
Threat Intelligence Release 350

Release Notes | September 2026 Important Communications Updates to correlation rules, field extraction, and event parsing across multiple vendors.
  • Improvements to detection accuracy and false positive reduction may affect correlation behavior for Microsoft Windows, Office 365, and Fortinet environments.
  • Changes may affect filters or correlations that reference vendor specific fields.
New Detections
  • Detection for AI agent or LLM runtime launched by a suspicious parent process on Windows
  • Detection for first-seen AI runtime or agent binary on Windows hosts
  • Detection for AI API calls from non-browser scripting or tooling processes on Windows
  • Detection for MCP server processes listening on non-loopback sockets on Windows
  • Detection for AI agent processes reading credential material or secret files on Windows
  • Detection for local LLM runtimes listening on non-loopback sockets on Windows
  • Detection for AI coding agents spawning sensitive child processes on Windows
  • Detection for Microsoft 365 Copilot interactions triggering a JailbreakDetected audit verdict
  • Detection for weakening or removing AWS Bedrock guardrails via AWS CloudTrail
  • Detection for disabling or altering AWS Bedrock model invocation logging configurations via AWS CloudTrail
  • Detection for active exploitation attempts against AI infrastructure based on Suricata NIDS signatures
  • Detection for rapid access to multiple distinct generative AI services from a single host using Palo Alto PAN-OS events
  • Detection for anomalous data uploads to generative AI destinations based on Darktrace alerts
  • Detection for first-seen usage of generative AI applications on Fortinet FortiGate
  • Detection for cross-prompt injection attacks against Microsoft 365 Copilot interactions
  • Detection for repeated file uploads to generative AI applications on Fortinet FortiGate
  • Detection for ransomware executables staged in the Windows PerfLogs directory
  • Detection for Windows LockScreenContentServer sideloading from non-standard paths
  • Detection for suspicious usage of XZ utils
Detection and Correlation Improvements
  • Improved accuracy for Microsoft Office 365 Suspicious MS Teams Chat with External User detections by adding checks for Support and HelpDesk variations
  • Reduced false positives in Windows User Privilege Escalation detections by excluding legitimate Mozilla Firefox background processes
  • Increased severity to Medium and reduced false positives for Windows ShimCache Persistence detections by excluding default Microsoft update registry paths
  • Improved accuracy for Microsoft Office 365 ATP phishing detections by adding recognized email security vendors to the global correlation list
  • Fixed criteria for Fortinet FortiGate VPN Successful Authentication After Brute Force detections to properly trigger on successful IPsec VPN authentications
  • Reduced false positives in Microsoft Exchange Suspicious inbox rule detections by implementing stricter string matching
Plugin Improvements
  • Improved field extraction for Palo Alto Cortex XDR alert and management logs
  • Improved parsing and normalization of country and sender fields in CheckPoint Harmony logs
  • Improved parsing of attacker IP addresses from the ipEvidence object in Microsoft Defender for Endpoint logs
  • Improved field extraction for Zimperium Mobile Device Security zIPS logs
  • Improved parsing and normalization for Ubiquiti NetFlow IPFIX events
  • Improved parsing for Fortinet FortiGate and FortiAuthenticator CEF logs
  • Added parsing support for Azure Microsoft Guest Configuration events
  • Added parsing support for Netwin SGRWIN Syslog Gateway events
  • Added parsing support for Dell EMC S4048 switch logs
  • Added parsing support for Axur One Ticket Feeds events
Fixes
  • Fixed parsing issues that caused missing event names and fields in Barracuda Web Application Firewall logs
  • Resolved an issue where Trustwave Secure Web Gateway events were not automatically detected and parsed with correct event names
  • Resolved an issue where F5 BIG-IP events were incorrectly parsed as generic data sources

​
Threat Intelligence Release 349

Release Notes | August 2026 Important Communications The following parser and event normalization updates may affect orchestration rules, filters, reports, or correlation behavior that reference vendor-specific fields, event names, or normalized values.
  • Mimecast Threat Reporting events were updated to improve field extraction for message, recipient, reporter, and threat analysis values.
  • Bitdefender GravityZone incident events were updated to use detection names, incident types, and attack types for more specific event names.
  • Veeam Backup events were updated to use consistent event names for backup and restore activity.
  • Cisco Identity Services Engine events were updated to extract additional accounting, profiling, identity, network device, and DHCP fields.
  • MOVEit Transfer NXLog event names were updated to consistently group automation user activity.
  • Click Studios Passwordstate RDP and SSH event names were updated to consistently group related remote access activity.
New Detections
  • Detection for repeated failed Active Directory authentications reported by F5 BIG-IP Access Policy Manager.
  • Detection for abnormal Microsoft 365 Exchange email sending rates.
  • Detection for Microsoft Entra ID users successfully logging in from multiple countries without requiring source workstation data.
  • Detection for multiple Microsoft Teams chats created by external onmicrosoft.com accounts.
  • Detection for suspicious remote content retrieval through headless Windows Console Host processes.
  • Detection for PowerShell commands that disable Microsoft Defender script scanning, network protection, web content evaluation, or SmartScreen.
  • Detection for suspicious child processes launched by Microsoft AutoGen Studio host processes.
  • Detection for Microsoft 365 inbox rules that move messages from postmaster@outlook.com.
  • Detection for high-volume Microsoft 365 MailItemsAccessed activity.
Detection and Correlation Improvements
  • Improved possible replay attack detection by requiring multiple related events within a short period, reducing alerts caused by isolated time synchronization issues.
  • Improved outbound SSH connection detection by excluding expected Bitvise SSH Server and Bitvise SSH Client processes.
  • Improved Microsoft Teams suspicious external chat detection by checking sender usernames for suspicious top-level domains.
  • Improved Microsoft Exchange suspicious inbox rule detection by checking email subject values parsed into additional fields.
  • Improved CrowdStrike intelligence detections to include events with new and in-progress statuses.
  • Improved Microsoft Teams suspicious external chat detection by checking external account display names, email-like display names, and IT-related onmicrosoft.com usernames.
  • Improved Microsoft Teams suspicious external chat detection by identifying external display names containing engineering, administrative, management, maintenance, or system-related terms.
  • Improved Duo multiple user account deletion detection by excluding expected deletions performed by the System account.
Plugin Improvements
  • Added syslog parsing support for Safran SecureSync 2400.
  • Added syslog parsing support for Cisco Secure Workload.
  • Added DataDome and Datadog JSON log parsing support for bot detection, HTTP activity, environment, and service fields.
  • Added parsing support for Microsoft Azure Storage Account Availability metrics.
  • Added syslog parsing support for Dell PowerVault ME5012.
  • Improved Microsoft Office 365 Audit parsing by extracting Microsoft Teams ChatThreadId values.
  • Improved Microsoft Office 365 Azure AD parsing by extracting ResultStatusDetail from UserLoggedIn events.
  • Improved Microsoft Azure Monitor Agent parsing by normalizing Windows Security EventData values, including usernames, domains, IP addresses, ports, logon types, authentication packages, security identifiers, and logon identifiers.
  • Improved Palo Alto Cortex XDR Alert parsing by extracting case ID values.
  • Improved Microsoft Office 365 Entra Sign-ins parsing by replacing Generic event names with event-specific names.
  • Improved Microsoft Office 365 Entra Directory Audits parsing by extracting result reasons, target resource display names, modified property values, and user principal names.
  • Improved Microsoft Office 365 Entra Directory Audits parsing by replacing Generic event names with event-specific names.
  • Improved Microsoft Azure Blob Storage authentication parsing by extracting identity type, token hash, user agent, and URI values.
  • Improved Mimecast Threat Reporting parsing by extracting subject, sent date, report date, sender header, recipient count, reporter count, and threat analysis values.
  • Improved Bitdefender GravityZone incident parsing by assigning event names based on detection names, incident types, and attack types.
  • Improved Google Workspace Audit parsing by correcting login failure event names and extracting organization, initiation, failure type, application, customer, qualifier, and IP autonomous system values.
  • Improved Juniper EX Series parsing by assigning event-specific names instead of Generic event names.
  • Improved WatchGuard XTM parsing by extracting source and destination IP addresses instead of using the firewall address for both values.
  • Improved Palo Alto Panorama audit log parsing by extracting event names, operation types, administrator usernames, commands, target objects, configuration paths, operation results, device identifiers, hostnames, and timestamps.
  • Improved Veeam Backup parsing by assigning consistent event names to backup and restore activity.
  • Improved Cisco Identity Services Engine parsing by extracting additional accounting, profiling, identity, network device, DHCP, endpoint, and storage fields.
  • Improved MOVEit Transfer NXLog parsing by normalizing event names for automation user activity.
  • Improved Click Studios Passwordstate parsing by normalizing related RDP and SSH event names.
  • Improved Fortinet FortiGate parsing by extracting the appact field from traffic events.
  • Improved Somansa WebKeeper parsing by normalizing dated and unnamed events and correcting source, destination, port, category, action, and policy mappings.
  • Improved Windows NXLog parsing for Windows Security Event ID 5449 by extracting provider context key, provider context name, and provider context type.
  • Improved Windows NXLog parsing for Windows Security Event ID 5447 by extracting filter key, filter name, and layer name.
  • Improved Cisco Meraki Air Marshal parsing by extracting wireless network, access point, VLAN, signal strength, frame type, authentication, identity, and client activity fields.
Fixes
  • Resolved an issue where Bitdefender GravityZone incident events used the same generic event name for different incident types.
  • Resolved an issue where Veeam Backup events used raw payload values instead of consistent event names.
  • Resolved an issue where MOVEit Transfer NXLog automation events were split into multiple unique event names instead of being grouped consistently.
  • Resolved an issue where Click Studios Passwordstate RDP and SSH events were split across inconsistent event names.
  • Resolved an issue where Juniper EX Series events were reported as Generic events.
  • Resolved an issue where WatchGuard XTM events used the firewall address instead of the source and destination IP addresses present in the logs.
  • Resolved an issue where Palo Alto Panorama audit events were reported without event names or searchable administrative activity fields.
  • Resolved an issue where Microsoft Office 365 Entra Sign-ins events were reported as Generic events.
  • Resolved an issue where Microsoft Office 365 Entra Directory Audits events were reported as Generic events.
  • Resolved an issue where Google Workspace Audit login failure events had incomplete event names and missing fields.
  • Resolved an issue where Somansa WebKeeper events used timestamps or empty values as event names and mapped network fields incorrectly.

​
Threat Intelligence Release 348

Release Notes | July 2026 Important Communications The following parser and event normalization updates may affect orchestration rules, filters, reports, or correlation behavior that reference vendor specific fields, event names, or normalized values.
  • ExaGrid Audit Logs Parser events were updated to populate event names for events that were previously parsed without an event name
  • Ruckus WAP events were updated to extract usable fields and improve normalization for wireless controller syslog events
  • Cisco ESA Email Security Cloud parsing was updated to reduce Generic event output and improve field extraction from syslog events
  • SentinelOne Singularity Operations Center BlueApp events were updated to use SentinelOne specific event names instead of Generic event names
  • Juniper EX Series event naming was updated to support logs that include the %INTERACT-6- prefix
New Detections
  • Detection for postinstall execution associated with the Mastra npm supply chain compromise using setup.cjs or easy-day-js execution through node or node.exe
  • Detection for PowerShell execution using NoProfile, ExecutionPolicy Bypass, WindowStyle Hidden, and script file execution
  • Detection for Windows registry symbolic link creation under CloudFiles BlockedApps associated with MiniPlasma style activity
  • Detection for Nimbus RAT payload execution using bundled OpenJDK from InboxCorePro staging paths
  • Detection for Copy Fail activity associated with CVE-2026-31431
  • Detection for Remcos DonutLoader staging through SyncAppvPublishingServer, cscript.exe, PowerShell, and Invoke-Expression
Detection and Correlation Improvements
  • Improved Microsoft Exchange suspicious inbox rule detection by adding checks for suspicious inbox rule names and business email compromise related email subject values
  • Improved Microsoft Defender for Office 365 phishing detection by excluding OutboundSpam events with External delivery locations when the related email was already quarantined
  • Improved Fortinet FortiGate infected file detection by excluding blocked web redirector detections that did not provide meaningful file detection signal
  • Improved SentinelOne Malware Detected correlation behavior by using both mitigation status and agent mitigation mode to reduce alarms for threats already mitigated or protected
  • Improved Windows recovery environment disabled via reagentc detection by excluding expected activity from system and machine accounts
  • Improved Fortinet FortiGate automated login logout detection to reduce low-signal alerts from short administrative sessions
  • Improved PowerShell encoded command detection by excluding known PowerShell AST parser script activity
  • Improved Windows WerFault detection for wermgr.exe execution from non-standard Windows directories
Plugin Improvements
  • Added Mimecast Events Collection support for JSON formatted Mimecast security events
  • Added Lenovo ThinkSystem DM3010H syslog parsing support
  • Added Wiz Vulnerability Management API collection support
  • Added Progress Kemp LoadMaster Web Application Firewall syslog parsing support
  • Added OpenText NetIQ eDirectory LDAP CEF parsing support
  • Added Netscout Arbor Sightline DDoS syslog parsing support with autodiscovery handling
  • Added Check Point Infinity Portal CEF parsing support for Check Point Harmony SASE, Harmony Endpoint, and SD-WAN logs
  • Added ManageEngine Endpoint Central syslog parsing support for audit and endpoint management events
  • Improved Proofpoint On Demand BlueApp collection to include audit stream support and preserve additional JSON payload fields
  • Improved Fortinet FortiGate Rogue AP detected events by parsing the onwire field
  • Improved Fortinet FortiGate CEF autodetection for FortiGate-601F devices
  • Improved Fortinet FortiGate CEF parsing by mapping the FTNTFGTcfgattr field for configuration attribute changes
  • Improved Ruckus WAP parsing by extracting wireless controller fields and normalizing client and endpoint values
  • Improved Cisco ESA Email Security Cloud parsing to reduce Generic event handling and improve syslog field extraction
  • Improved Senha Segura parsing for Senha Expirada events by extracting the affected destination username
  • Improved Shorewall Firewall parsing so Firewall TCP Drop events are categorized as Shorewall Firewall instead of Linux Kernel
  • Improved Citrix NetScaler parsing by extracting HTTP request URLs from HTTPREQUEST events
  • Improved Microsoft Office 365 Azure AD parsing by extracting User ID for Update StsRefreshTokenValidFrom Timestamp events
  • Improved Sophos Central JSON parsing by extracting the unmet_prerequisites field
  • Improved Cisco Meraki AUTER parsing by normalizing firewall and VPN firewall actions from pattern values
  • Improved Cisco Firepower Management Center parsing by extracting usernames from audit login events
  • Improved NGINX and DataDome log parsing by normalizing OCSF HTTP activity fields, HTTP response values, DataDome bot details, and event names
  • Improved ManageEngine PAM360 parsing by extracting ResourceAudit and UserAudit fields
  • Improved Cisco Meraki AUTER parsing by normalizing user agent values
  • Improved Cisco Duo Activity parsing by extracting response_info values under target detail for fraud related activity
  • Improved Linux audit PATH event parsing by extracting audit event ID, item number, file path, inode, and device values
Fixes
  • Resolved an issue where ExaGrid Audit Logs Parser events were parsed without event names
  • Resolved an issue where SentinelOne Singularity Operations Center BlueApp events were ingested as Generic event instead of SentinelOne specific event names
  • Resolved an issue where Juniper EX Series events were missing updated event names after the %INTERACT-6- log prefix was added
  • Resolved an issue where Windows NXLog IIS HTTP OK events parsed incorrect source IP and hostname values
  • Resolved an issue where Linux audit PATH events did not correctly parse file path and related audit fields

​
Threat Intelligence Release 347

Release Notes | June 2026 Important Communications This release includes updates to event parsing, field extraction, event naming, and new log source support. These changes may affect orchestration rules, saved searches, dashboards, and correlations that reference vendor-specific fields, event names, or normalized values.
  • Resolved missing data sources for Microsoft Defender for Endpoint schedulers
  • Added field extraction for Microsoft Office 365 Audit TeamsAdminAction events
  • Updated Microsoft Office 365 Azure AD UserLoggedIn event field mapping
  • Added field extraction for Netskope CEF compromised credential events
  • Added field extraction for Okta identity events
  • Added field extraction for Senha Segura privileged access events
  • Added field extraction for Salesforce Activity InsufficientAccess events
  • Added field extraction for Cato Networks Cloud-based NGFW DNS Protection events
  • Updated Citrix NetScaler event naming to differentiate HTTP request methods
  • Expanded parsing coverage for AlienVault Agent Windows Event Log events
  • Added new log source support for Peplink Balance 3xx switches
  • Added new log source support for HPE FlexFabric 5710 Switch Series
  • Added new log source support for UILA uObserve
  • Changes may affect filters or correlations that reference vendor-specific event names, extracted fields, or normalized values
New Detections
  • Detection for searches of Group Policy Preference password files that may indicate attempts to recover stored credentials in Active Directory environments
  • Detection for ASP.NET ViewState deserialization vulnerability activity associated with CVE-2026-5426
  • Detection for attempts to disable Windows Credential Guard through registry modifications
  • Detection for abuse of nslookup and findstr to retrieve and execute commands through DNS-based techniques
  • Detection for suspicious child process activity originating from Microsoft Semantic Kernel agent environments
  • Detection for sensitive Windows file collection using print.exe
  • Detection for successful legacy SMTP authentication activity using BAV2ROPC
  • Detection for PowerShell-based remote archive download, extraction, and execution chains
  • Detection for macOS AMOS stealer style archive creation, file splitting, and upload activity
  • Detection for Windows Axios supply chain attack activity involving script execution and outbound command activity
  • Detection for Quarian backdoor activity
Detection and Correlation Improvements
  • Reduced false positives in PowerShell Execution of Encoded Command detections by improving handling of Windows Admin Center uninstall activity
  • Updated OfficeLaunchExe detection coverage for Windows child processes launched by Microsoft Word
Plugin Improvements
  • Improved Microsoft Office 365 Audit parsing for TeamsAdminAction events, including ModifiedProperties.OldValue and ModifiedProperties.NewValue fields
  • Improved Microsoft Office 365 Azure AD parsing for UserLoggedIn events, including SessionID and Device ID field mapping
  • Added extraction of the ccMatchedUsername field for Netskope CEF compromised credential events
  • Improved Falco event parsing for Kubernetes namespace and pod name values
  • Added field extraction for Senha Segura privileged access logs, including cs label fields, tenant, user, access policy, and access profile values
  • Improved Okta event parsing for risk, user behavior, displayName, and target fields
  • Improved parsing coverage for HPE OfficeConnect 1910 to 1950 switch logs
  • Improved Apache Tomcat log identification so Apache Tomcat events are parsed by the Apache Tomcat parser
  • Expanded field extraction for Aruba 9000 Gateway logs, including MAC address, ICMP, action, policy, process, hostname, and process ID fields
  • Added parsing support for Peplink Balance 3xx switch logs
  • Added parsing support for HPE FlexFabric 5710 Switch Series logs
  • Added parsing support for UILA uObserve logs
  • Improved Citrix NetScaler event naming for HTTP GET, POST, PUT, DELETE, and related HTTP request methods
  • Expanded field extraction for AlienVault Agent Windows Event Log events, including TargetSid, AllowedToDelegateTo, AccountExpires, and UserWorkstations fields
  • Improved event naming for Ubiquiti UniFi syslog events
  • Added parsing support for the dns_protection_category field in Cato Networks Cloud-based NGFW DNS Protection events
  • Added field extraction for Salesforce Activity InsufficientAccess events, including Access Error and Entity Type fields
Fixes
  • Resolved an issue where Microsoft Defender for Endpoint data sources were missing from available schedulers
  • Resolved an issue where McAfee Web Gateway Cloud events were generated with blank event names
  • Resolved an issue where Apache Tomcat logs were categorized as generic events instead of being parsed by the Apache Tomcat parser
  • Resolved an issue where Citrix NetScaler HTTP request events used a single HTTPREQUEST event name instead of differentiating HTTP request methods
  • Resolved parsing issues affecting Veeam Backup syslog events
  • Resolved missing event names for Ubiquiti UniFi syslog events
  • Resolved missing field extraction for Cato Networks Cloud-based NGFW DNS Protection events
  • Resolved missing field extraction for Salesforce Activity InsufficientAccess events

​
Threat Intelligence Release 346

Release Notes | May 2026 Important Communications This release included parser, normalization, event naming, and field extraction updates that may affect orchestration rules, filters, reports, and correlations that reference vendor specific fields or event names.
  • Updates to event naming and normalization for OpenGear Out-of-Band Management, Avanan Email Security SmartDLP, MOVEit Transfer NXLog, SonicWall UTM, and Netskope events
  • Field extraction improvements for Microsoft Office 365 SharePoint, Microsoft Office 365 Audit, Cisco Umbrella Proxy, Google G Suite Drive, CrowdStrike Identity Alert Logs, Cisco Meraki AUTER, and Linux Kernel events
  • Linux Services parser updates for Amavis and Zimbra Mail Server logs improved handling of complex message flow details, repeated entries, and large recipient lists
  • Changes may affect filters or correlations that reference vendor specific event names, authentication fields, VPN fields, host name fields, firewall fields, or extracted file name values
New Detections
  • Detection for CVE-2026-33829 Snipping Tool NTLM leak activity involving Snipping Tool URI execution and public network connections
  • Detection for Windows LSA boot key registry access by a non-LSASS process
  • Detection for direct RPC calls to the Windows Defender update endpoint by a non-Windows Update process
  • Detection for Microsoft Defender for Endpoint Sapphire Sleet actor activity
  • Detection for command-line discovery of installed security products, including Windows Defender, Malwarebytes Endpoint Agent, Trend Micro Security, Kaspersky Endpoint Security, Webroot, ESET, and Avast
Detection and Correlation Improvements
  • Updated macOS AVAgent detection coverage to include activity involving the /tmp/helper staging cache directory
  • Updated indicator of interest detections to align with revised high confidence indicator names for general, command and control, stealer, and fast-flux activity
  • Reduced false positives in Windows PowerShell encoded command detections related to Microsoft Windows Admin Center configuration activity
  • Improved Windows Kerberos account enumeration correlation coverage by relaxing overly restrictive matching logic
  • Removed a verified non-malicious indicator from OTX Pulse based alarm generation to reduce false positive alarms
Plugin Improvements
  • Added parsing support for Barracuda Sentinel email security, Coraza WAF, Pulp 3 pulpcore-api, Cohesity DataPlatform API audit, and Sophos Central case events
  • Improved Microsoft Office 365 SharePoint and Microsoft Office 365 Audit parsing to extract authentication related fields, including AuthenticationType, OldValue, and NewValue details
  • Improved Cisco Meraki AUTER parsing for AnyConnect VPN events, including event names, authenticating users, VPN IP addresses, and source IP addresses
  • Improved Cisco Umbrella Proxy, Google G Suite Drive, and CrowdStrike Identity Alert Logs parsing to extract additional file name, application, and host name fields
  • Improved Linux Kernel iptables parsing to extract source, destination, action, and port number details
  • Improved zScaler NSS Web Logs parsing to extract device owner and device hostname fields
  • Improved Trend Micro Deep Security parsing to support TrendAI vendor naming changes
Fixes
  • Resolved issues where OpenGear Out-of-Band Management, Netskope, and Passwordstate Syslog events displayed without proper normalization or event names
  • Resolved issues where Linux Services logs from Amavis and Zimbra Mail Server were incorrectly routed to the Generic Plugin instead of the Linux Services parser
  • Resolved issues where Avanan Email Security SmartDLP, MOVEit Transfer NXLog, and SonicWall UTM events generated inconsistent or overly unique event names that impacted reporting and rule creation
  • Resolved issues where Linux Kernel iptables events did not display complete source, destination, action, and port number details
See Older Release Notes in Success Center