What's new

Enterprise Security Content Updates v3.45.0 was released on July 21, 2022. It includes the following enhancements.

New analytic story

• Azorult
• Windows System Binary Proxy Execution MSIExec

New analytics

• Detect Risky SPL using Pretrained ML Model
• Living Off The Land (New Search type: RBA)
• Windows Application Layer Protocol RMS Radmin Tool Namedpipe
• Windows Binary Proxy Execution Mavinject DLL Injection
• Windows Gather Victim Network Info Through Ip Check Web Services
• Windows Identify Protocol Handlers
• Windows Impair Defense Add Xml Applocker Rules
• Windows Impair Defense Deny Security Software With Applocker
• Windows Modify Registry Disable Toast Notifications
• Windows Modify Registry Disable Win Defender Raw Write Notif
• Windows Modify Registry Disable Windows Security Center Notif
• Windows Modify Registry Disabling WER Settings
• Windows Modify Registry DisAllow Windows App
• Windows Modify Registry Regedit Silent Reg Import
• Windows Modify Registry Suppress Win Defender Notif
• Windows MOF Event Triggered Execution via WMI
• Windows Odbcconf Hunting
• Windows Odbcconf Load DLL
• Windows Odbcconf Load Response File
• Windows Powershell Import Applocker Policy
• Windows Remote Access Software RMS Registry
• Windows Remote Service Rdpwinst Tool Execution
• Windows Remote Services Allow Rdp In Firewall
• Windows Remote Services Allow Remote Assistance
• Windows Remote Services Rdp Enable
• Windows Service Stop By Deletion
• Windows Valid Account With Never Expires Password

Updated analytics

• Allow Inbound Traffic By Firewall Rule Registry
• Cobalt Strike Named Pipes
• Office Product Writing cab or inf
• Powershell Disable Security Monitoring
• Suspicious Image Creation In Appdata Folder

Other updates

• Updated all 4104 Analytics and corresponding attack datasets to use the XML log format
• Added providing technologies to populate Recommended Data Sources in Usecase Library in Enterprise Security
• Updated lookup typo: security_services.csv
• Made several updates to the contentctl_project and docker_detection_testing backend tooling
• Updated Splunk app baseline to test against the latest TAs
• Deprecated GCP GCR container uploaded and New container uploaded to AWS ECR