Releases: splunk/security_content
v5.1.0
Release notes - v5.1.0
Key highlights
We released 4 new analytic stories and added 41 new detection analytics. Some high level details of the new analytic stories in this release
-
📡 Remote Monitoring and Management Software: Added a new story file to help users analyze unauthorized remote monitoring & management (RMM) tool usage, including detection of 3rd-party software installations like AnyDesk and TeamViewer through phishing/drive-by compromises.
-
☁️ AWS S3 Bucket Security Monitoring: A new analytic story which addresses the risks associated with S3 bucket misconfigurations and potential hijacking of decommissioned buckets. This story includes baselines and detections that track public S3 buckets before deletion, monitor access attempts to these bucket names, and identify potential hijacking activities, leveraging AWS CloudTrail logs, DNS queries, and web proxy data to ensure robust monitoring and security.
-
🛡️ Security Solution Tampering: A new analytic story, which includes new detections focused on identifying tampering activities with Cisco Secure Endpoint services. These detections cover techniques such as inhibiting system recovery and disabling or modifying security tools, enhancing our ability to detect and respond to potential security threats.
-
📋 Windows Audit Policy Tampering: We also added detections for Windows audit policies, which are crucial for logging key system activities for monitoring and forensic analysis. This analytic story provides a framework to detect suspicious activities involving audit policy manipulation, such as the use of auditpol.exe with specific flags, helping to uncover potential malicious activity and maintain the integrity of security monitoring mechanisms.
-
In addition, external contributor @nterl0k has significantly enhanced our detection capabilities with six new Office 365 security detections and several other detections.. These include monitoring changes to email transport rules, various methods of data exfiltration, and suspicious authentication and search behaviors, providing robust protection against potential threats.
New Analytic Story - [4]
- AWS S3 Bucket Security Monitoring
- Remote Monitoring and Management Software (External Contributor: @nterl0k)
- Security Solution Tampering
- Windows Audit Policy Tampering
New Analytics - [41]
- Cisco Secure Application Alerts
- Cisco AI Defense Security Alerts by Application Name
- Detect Web Access to Decommissioned S3 Bucket
Detect DNS Query to Decommissioned S3 Bucket - O365 Email Transport Rule Changed (External Contributor: @nterl0k)
- O365 Exfiltration via File Access (External Contributor: @nterl0k)
- O365 Exfiltration via File Download (External Contributor: @nterl0k)
- O365 Exfiltration via File Sync Download (External Contributor: @nterl0k)
- O365 Multiple OS Vendors Authenticating From User (External Contributor: @nterl0k)
- O365 SharePoint Suspicious Search Behavior (External Contributor: @nterl0k)
- Potential Telegram API Request Via CommandLine (External Contributor: @zake1god)
- Windows Audit Policy Auditing Option Disabled via Auditpol
- Windows Audit Policy Auditing Option Modified - Registry
- Windows Audit Policy Cleared via Auditpol
- Windows Audit Policy Disabled via Auditpol
- Windows Audit Policy Disabled via Legacy Auditpol
- Windows Audit Policy Excluded Category via Auditpol
- Windows Audit Policy Restored via Auditpol
- Windows Audit Policy Security Descriptor Tampering via Auditpol
- Windows BitLocker Suspicious Command Usage (External Contributor: @nterl0k)
- Windows Cisco Secure Endpoint Related Service Stopped
- Windows Cisco Secure Endpoint Stop Immunet Service Via Sfc
- Windows Cisco Secure Endpoint Unblock File Via Sfc
- Windows Cisco Secure Endpoint Uninstall Immunet Service Via Sfc
- Windows Compatibility Telemetry Suspicious Child Process
- Windows Compatibility Telemetry Tampering Through Registry
- Windows Event Logging Service Has Shutdown
- Windows Global Object Access Audit List Cleared Via Auditpol
- Windows Important Audit Policy Disabled
- Windows PowerShell Process With Malicious String (External Contributor: @nterl0k)
- Windows PowerShell Script Block With Malicious String (External Contributor: @nterl0k)
- Windows Process Executed From Removable Media (External Contributor: @nterl0k)
- Windows Process Execution in Temp Dir
- Windows Remote Desktop Network Bruteforce Attempt
- Windows Security And Backup Services Stop
- Windows Service Created with Suspicious Service Name
- Windows Suspicious Driver Loaded Path
- Windows Suspicious Process File Path
- Windows System Remote Discovery With Query
- Windows USBSTOR Registry Key Modification (External Contributor: @nterl0k)
- Windows WPDBusEnum Registry Key Modification (External Contributor: @nterl0k)
(Big thank you to @nterl0k from our Github Community for contributing several amazing tested detections, stories, lookups for this release! )
Macros Added - [4]
- important_audit_policy_subcategory_guids
- normalized_service_binary_field
- process_auditpol
- windows_exchange_iis
Macros Updated - [11]
- ms_defender
- powershell
- printservice
- remoteconnectionmanager
- sysmon
- wineventlog_application
- wineventlog_rdp
- wineventlog_security
- wineventlog_system
- wineventlog_task_scheduler
- wmi
Lookups Added - [2]
- malicious_powershell_strings
- windows_suspicious_services
Lookups Updated - [5]
- asr_rules
- builtin_groups_lookup
- dynamic_dns_providers_default
- remote_access_software
- security_services_lookup
Other updates
- New baselines: Baseline Of Open S3 Bucket Decommissioning
- Added a dropdown for dashboards to the navigation bar
Contributors
Assets 3
v5.0.0
🌟 Github Community
🎉 The Splunk Threat Research Team is thrilled to announce Enterprise Security Content Update (ESCU) v5.0.0!
Key Highlights
-
(NEW) 🚨 Deprecation Assistant Dashboard: This release introduces a deprecation assistant dashboard for ESCU users to identify and manage deprecated detection analytics currently enabled in their Splunk Environment. These detections will be removed in ESCU v5.2.0 and could disrupt environments using them. For more in-depth information about which pieces of content will be removed and their replacements, please refer to the docs - 📄 Documentation.
-
(NEW) 🛠️ Analytic Story Onboarding Assistant: In this release, we've introduced a redesigned home page with an enhanced UI that offers direct access to release notes, analytics counts, and the latest version on Splunkbase, complemented by a detailed timeline of STRT blogs and updates. Additionally, we've launched the Analytic Story Onboarding Assistant, a new preview feature designed to streamline the process of enabling several detections from multiple analytics stories for which there is data available in your Splunk Environment.
-
🔍 New Analytics: We have expanded our threat detection capabilities by mapping existing analytics and developing new detections for a range of threats, including Backdoor Pingpong, Cleo File Transfer Software, Crypto Stealer, SDDL Tampering Defense Evasion, Derusbi, Earth Estries, Nexus APT Threat Activity, WinDealer RAT, and XorDDos.
New Analytic Story - [9]
- Backdoor Pingpong
- Cleo File Transfer Software
- Crypto Stealer
- Defense Evasion or Unauthorized Access Via SDDL Tampering
- Derusbi
- Earth Estries
- Nexus APT Threat Activity
- WinDealer RAT
- XorDDos
New Analytics - [52]
- ASL AWS Create Access Key
- ASL AWS Create Policy Version to allow all resources
- ASL AWS Credential Access GetPasswordData
- ASL AWS Credential Access RDS Password reset
- ASL AWS Defense Evasion PutBucketLifecycle
- ASL AWS Detect Users creating keys with encrypt policy without MFA
- ASL AWS Disable Bucket Versioning
- ASL AWS EC2 Snapshot Shared Externally
- ASL AWS IAM AccessDenied Discovery Events
- ASL AWS IAM Assume Role Policy Brute Force
- ASL AWS Network Access Control List Created with All Open Ports
- ASL AWS Network Access Control List Deleted
- ASL AWS SAML Update identity provider
- ASL AWS UpdateLoginProfile
- Azure AD AzureHound UserAgent Detected
- Azure AD Service Principal Enumeration
- Azure AD Service Principal Privilege Escalation
- Detect Remote Access Software Usage Registry
- Microsoft Intune Device Health Scripts
- Microsoft Intune DeviceManagementConfigurationPolicies
- Microsoft Intune Manual Device Management
- O365 Service Principal Privilege Escalation
- Windows Account Access Removal via Logoff Exec
- Windows CertUtil Download With URL Argument
- Windows DNS Query Request by Telegram Bot API
- Windows Detect Network Scanner Behavior
- Windows File and Directory Enable ReadOnly Permissions
- Windows File and Directory Permissions Enable Inheritance
- Windows File and Directory Permissions Remove Inheritance
- Windows Impair Defenses Disable Auto Logger Session
- Windows New Custom Security Descriptor Set On EventLog Channel
- Windows New Deny Permission Set On Service SD Via Sc.EXE
- Windows New EventLog ChannelAccess Registry Value Set
- Windows New Service Security Descriptor Set Via Sc.EXE
- Windows Obfuscated Files or Information via RAR SFX
- Windows Office Product Dropped Cab or Inf File
- Windows Office Product Dropped Uncommon File
- Windows Office Product Spawned Control
- Windows Office Product Spawned MSDT
- Windows Office Product Spawned Rundll32 With No DLL
- Windows Office Product Spawned Uncommon Process
- Windows Powershell Logoff User via Quser
- Windows Process With NetExec Command Line Parameters
- Windows Registry Dotnet ETW Disabled Via ENV Variable
- Windows Remote Management Execute Shell
- Windows ScManager Security Descriptor Tampering Via Sc.EXE
- Windows Service Execution RemCom
- Windows Service Stop Attempt
- Windows Set Account Password Policy To Unlimited Via Net
- Windows SubInAcl Execution
- Windows Suspicious Child Process Spawned From WebServer
- Windows User Discovery Via Net
Other Updates
- We've updated our YAML configurations by enhancing validation, improving accuracy and consistency, and replacing the 'observables' key with an 'RBA' key to better align with Enterprise Security standards and simplify risk attribution.
v4.44.0
STRT is excited to welcome @nasbench to the team! Congrats on your first of many PRs! #3213
Release notes - v4.44.0
Total New and Updated Content: [357]
Key highlights
- Windows Defender: Two new analytics now surface and summarize alerts from Microsoft Defender Advanced Threat Protection (ATP) as well as Microsoft Defender O365 Incidents.
- BitLockerToGo Abuse: Two new analytics search for use of the legitimate BitLockerToGo.exe Windows utility. This application has been abused by the Lumma Stealer malware to manipulate registry keys, search for cryptocurrency wallets or credentials, and exfiltrate sensitive data.
- VaultCLI Usage: One new analytic flags suspicious usage of the VaultCLI.dll, a technique observed by Information-Stealing Malware such as Meduza. This DLL allows processes to extract sensitive credentials from the Windows Credential Vault.
- Windows RDP Activities: Two new analytics look for potentially suspicious Windows RDP activities.
- Windows RunMRU Modifications: One analytic monitors changes to the RunMRU registry key. This key, which stores a history of commands executed via the windows Run dialog box, may capture commands run by malware attempting to appear legitimate.
New Analytic Story - [3]
New Analytics - [8]
- Microsoft Defender ATP Alerts
- Microsoft Defender Incident Alerts
- Windows BitLockerToGo Process Execution
- Windows BitLockerToGo with Network Activity
- Windows Credentials Access via VaultCli Module
- Windows RDP File Execution
- Windows RDPClient Connection Sequence Events
- Windows RunMRU Command Execution
Updated Analytics - [261]
- 7zip CommandLine To SMB Share Path
- Active Setup Registry Autostart
- Add DefaultUser And Password In Registry
- Add or Set Windows Defender Exclusion
- Allow Inbound Traffic By Firewall Rule Registry
- Allow Operation with Consent Admin
- Any Powershell DownloadFile
- Attacker Tools On Endpoint
- Attempted Credential Dump From Registry via Reg exe
- Auto Admin Logon Registry Entry
- BCDEdit Failure Recovery Modification
- Batch File Write to System32
- CMD Echo Pipe - Escalation
- CertUtil Download With URLCache and Split Arguments
- CertUtil Download With VerifyCtl and Split Arguments
- Certutil exe certificate extraction
- Clear Unallocated Sector Using Cipher App
- Clop Common Exec Parameter
- Clop Ransomware Known Service Name
- ConnectWise ScreenConnect Path Traversal Windows SACL
- Conti Common Exec parameter
- Control Loading from World Writable Directory
- Create Remote Thread In Shell Application
- Create local admin accounts using net exe
- Creation of Shadow Copy with wmic and powershell
- Creation of Shadow Copy
- Credential Dumping via Copy Command from Shadow Copy
- Credential Dumping via Symlink to Shadow Copy
- Curl Download and Bash Execution
- DNS Exfiltration Using Nslookup App
- DSQuery Domain Discovery
- Deleting Shadow Copies
- Detect AzureHound Command-Line Arguments
- Detect Certify Command Line Arguments
- Detect Distributed Password Spray Attempts
- Detect Exchange Web Shell
- Detect HTML Help Spawn Child Process
- Detect HTML Help URL in Command Line
- Detect HTML Help Using InfoTech Storage Handlers
- Detect MSHTA Url in Command Line
- Detect Password Spray Attempts
- Detect Regasm Spawning a Process
- Detect Regsvcs Spawning a Process
- Detect Regsvr32 Application Control Bypass
- Detect Rundll32 Application Control Bypass - advpack
- Detect Rundll32 Application Control Bypass - setupapi
- Detect Rundll32 Application Control Bypass - syssetup
- Detect Webshell Exploit Behavior
- Detect mshta inline hta execution
- Disable AMSI Through Registry
- Disable Defender AntiVirus Registry
- Disable Defender BlockAtFirstSeen Feature
- Disable Defender Enhanced Notification
- Disable Defender MpEngine Registry
- Disable Defender Spynet Reporting
- Disable Defender Submit Samples Consent Feature
- Disable ETW Through Registry
- Disable Logs Using WevtUtil
- Disable Registry Tool
- Disable Security Logs Using MiniNt Registry
- Disable Show Hidden Files
- Disable UAC Remote Restriction
- Disable Windows App Hotkeys
- [Disable Windows Behavior Monitoring](htt...
Contributors
Assets 3
v4.43.0
Release notes - v4.43.0
Total New and Updated Content: [1645]
Key highlights
Detection Analytics Updates
- Critical Alerts: Introduced a new analytic to detect critical alerts from multiple security tools, enhancing quick identification and response for high-priority threats. Tested with MS365 Defender and Windows Defender Alerts, compatible with any vendor alerts mapped to the Alerts data model.
- Braodo Stealer: Added detections focused on identifying malicious behaviors associated with information-stealing malware.
Tooling Updates
We have released new version of contentctl (v4.4.5) that help with build and test ESCU content:
- Enhanced Drilldowns: Added two default drilldowns for all notable detections, enabling users to view detection results for specific risk objects and access risk events from the past 7 days. This improves investigation workflows and response efficiency.
- Version Enforcement & Datasource Testing: Enhanced version enforcement for detection content, automatically updating search versions when YAML changes. Added new datasource testing for detections, ensuring compatibility when new TAs are available.
Documentation Update
Additionally, the Splunk documentation and Github Wiki is also updated to include the latest features shipped in the Enterprise Security Content Update (ESCU). This update provides detailed guidance on using and testing these detections with Splunk Enterprise Security.
New Analytic Story - [2]
New Analytics - [9]
- Detect Critical Alerts from Security Tools
- High Volume of Bytes Out to Url
- Internal Horizontal Port Scan NMAP Top 20
- Plain HTTP POST Exfiltrated Data
- Windows Archived Collected Data In TEMP Folder
- Windows Credentials from Password Stores Chrome Copied in TEMP Dir
- Windows Credentials from Web Browsers Saved in TEMP Folder
- Windows Disable or Stop Browser Process
- Windows Screen Capture in TEMP folder
Updated Analytics - [1532]
- All TTP/Anomaly and Correlation type detections now have two drilldowns added to their yaml files.
Huge thanks to @dluxtron for contributing new detections and enhancing existing ones!
Contributors
Assets 3
v4.42.0
Total New and Updated Content: [18]
Key Highlights:
Splunk Vulnerabilities: This release introduces key detections for recently disclosed Splunk vulnerabilities, including issues like disabling KVStore via CSRF, image file disclosure in PDF exports, and persistent XSS attacks. It also covers critical vulnerabilities such as remote code execution through arbitrary file writes and sensitive information disclosure in low-privileged user sessions and DEBUG logs. These detections enhance monitoring for exploitation attempts, improving Splunk's defenses against potential attacks and data breaches.
CISA AA24-241A : This new analytic story delivers detections tailored to identify malicious usage of PowerShell Web Access (PSWA) in Windows environments. These new detections focus on monitoring PowerShell Web Access activity through the IIS application pool and web access logs, providing enhanced visibility into suspicious or unauthorized access. The story introduces two key detections: "Windows Identify PowerShell Web Access IIS Pool" and "Windows IIS Server PSWA Console Access," which track the creation and usage of PSWA sessions, anomalies in IIS pool configurations, and unusual patterns of console access. By improving detection of PowerShell Web Access exploitation, we can defenses against potential privilege escalation, lateral movement, and remote code execution attempts within Windows infrastructures.
In addition to these updates, the detection logic for "Windows AdFind Exe" and "Linux Auditd Change File Owner To Root" has been improved based on customer feedback. These enhancements provide more accurate identification of AdFind tool usage in Windows environments and better detection of unauthorized file ownership changes to root in Linux systems, further fortifying defenses against privilege abuse and lateral movement techniques across both platforms.
New Analytic Story - [0]
Updated Analytic Story - [1]
New Analytics - [10]
- Splunk Disable KVStore via CSRF Enabling Maintenance Mode
- Splunk Image File Disclosure via PDF Export in Classic Dashboard
- Splunk Low-Priv Search as nobody SplunkDeploymentServerConfig App
- Splunk Persistent XSS via Props Conf
- Splunk Persistent XSS via Scheduled Views
- Splunk RCE Through Arbitrary File Write to Windows System Root
- Splunk SG Information Disclosure for Low Privs User
- Splunk Sensitive Information Disclosure in DEBUG Logging Channels
- Windows IIS Server PSWA Console Access
- Windows Identify PowerShell Web Access IIS Pool
Updated Analytics - [15]
- Create Remote Thread into LSASS
- Detect Regsvcs with Network Connection
- Linux Auditd Change File Owner To Root
- Possible Lateral Movement PowerShell Spawn
- Suspicious Process DNS Query Known Abuse Web Services
- Windows AdFind Exe
- Windows DISM Install PowerShell Web Access
- Windows Enable PowerShell Web Access
- Windows Impair Defenses Disable AV AutoStart via Registry
- Windows Modify Registry Utilize ProgIDs
- Windows Modify Registry ValleyRAT C2 Config
- Windows Modify Registry ValleyRat PWN Reg Entry
- Windows Privileged Group Modification
- Windows Scheduled Task DLL Module Loaded
- Windows Scheduled Tasks for CompMgmtLauncher or Eventvwr
Other Updates
- Updated README.md and WIKI on Github repository
v4.41.0
Key Highlights
ValleyRAT Analytic Story: This update introduces comprehensive detections tailored to the ValleyRAT malware, providing enhanced monitoring and threat-hunting capabilities for adversarial activity on Windows systems. The story includes new detections focusing on impairing defenses, modifying system registries, and exploiting privilege escalation mechanisms. Key detections cover tactics such as disabling antivirus via registry modifications, setting Windows Defender exclusions, and UAC bypass techniques like FodHelper and Eventvwr. These detections improve visibility into malicious registry changes, task scheduling anomalies, and suspicious executable behavior, fortifying defenses against ValleyRAT C2 activity and privilege abuse attempts.
Total New and Updated Content: [16]
New Analytic Story - [1]
Updated Analytic Story - [0]
New Analytics - [6]
Windows Impair Defenses Disable AV AutoStart via Registry
Windows Modify Registry Utilize ProgIDs
Windows Modify Registry ValleyRAT C2 Config
Windows Modify Registry ValleyRat PWN Reg Entry
Windows Schedule Task DLL Module Loaded
Windows Schedule Tasks for CompMgmtLauncher or Eventvwr
Updated Analytics - [9]
Add or Set Windows Defender Exclusion
CMLUA Or CMSTPLUA UAC Bypass
Eventvwr UAC Bypass
Executables Or Script Creation In Suspicious Path
FodHelper UAC Bypass
Suspicious Process File Path
WinEvent Windows Task Scheduler Event Action Started
Windows Access Token Manipulation SeDebugPrivilege
Windows Defender Exclusion Registry Entry
v4.40.0
Key highlights
Key Highlights for Enterprise Security Content Update version 4.40.0:
Compromised Linux Host: This update introduces a robust set of 50 detections for compromised Linux hosts, covering a wide range of activities such as unauthorized account creation, file ownership changes, kernel module modifications, privilege escalation, data destruction, and suspicious service stoppages, enhancing visibility into potential malicious actions and system tampering.
Black Suit Ransomware: We have tagged existing analytics, aligning with tactics, techniques, and procedures (TTPs) associated with the Black Suit ransomware, providing organizations with targeted threat detection capabilities to identify and mitigate ransomware attacks before they can cause significant damage.
CISA Alert (CISA AA24-241A): In response to a joint advisory regarding Iran-based cyber actors exploiting U.S. and foreign organizations, this update includes new detections for identifying PowerShell Web Access installations and enabling activities, strengthening defenses against ransomware and espionage activities linked to these threats.
Total New and Updated Content: [133]
New Analytic Story - [3]
Updated Analytic Story - [0]
New Analytics - [52]
- Linux Auditd Add User Account Type
- Linux Auditd Add User Account
- Linux Auditd At Application Execution
- Linux Auditd Auditd Service Stop
- Linux Auditd Base64 Decode Files
- Linux Auditd Change File Owner To Root
- Linux Auditd Clipboard Data Copy
- Linux Auditd Data Destruction Command
- Linux Auditd Data Transfer Size Limits Via Split Syscall
- Linux Auditd Data Transfer Size Limits Via Split
- Linux Auditd Database File And Directory Discovery
- Linux Auditd Dd File Overwrite
- Linux Auditd Disable Or Modify System Firewall
- Linux Auditd Doas Conf File Creation
- Linux Auditd Doas Tool Execution
- Linux Auditd Edit Cron Table Parameter
- Linux Auditd File And Directory Discovery
- Linux Auditd File Permission Modification Via Chmod
- Linux Auditd File Permissions Modification Via Chattr
- Linux Auditd Find Credentials From Password Managers
- Linux Auditd Find Credentials From Password Stores
- Linux Auditd Find Private Keys
- Linux Auditd Find Ssh Private Keys
- Linux Auditd Hardware Addition Swapoff
- Linux Auditd Hidden Files And Directories Creation
- Linux Auditd Insert Kernel Module Using Insmod Utility
- Linux Auditd Install Kernel Module Using Modprobe Utility
- Linux Auditd Kernel Module Enumeration
- Linux Auditd Kernel Module Using Rmmod Utility
- Linux Auditd Nopasswd Entry In Sudoers File
- Linux Auditd Osquery Service Stop
- Linux Auditd Possible Access Or Modification Of Sshd Config File
- Linux Auditd Possible Access To Credential Files
- Linux Auditd Possible Access To Sudoers File
- Linux Auditd Possible Append Cronjob Entry On Existing Cronjob File
- Linux Auditd Preload Hijack Library Calls
- Linux Auditd Preload Hijack Via Preload File
- Linux Auditd Service Restarted
- Linux Auditd Service Started
- Linux Auditd Setuid Using Chmod Utility
- Linux Auditd Setuid Using Setcap Utility
- Linux Auditd Shred Overwrite Command
- Linux Auditd Stop Services
- Linux Auditd Sudo Or Su Execution
- Linux Auditd Sysmon Service Stop
- Linux Auditd System Network Configuration Discovery
- Linux Auditd Unix Shell Configuration Modification
- Linux Auditd Unload Module Via Modprobe
- Linux Auditd Virtual Disk File And Directory Discovery
- Linux Auditd Whoami User Discovery
- Windows DISM Install PowerShell Web Access
- Windows Enable PowerShell Web Access
Updated Analytics - [72]
- ASL AWS Concurrent Sessions From Different Ips
- Access to Vulnerable Ivanti Connect Secure Bookmark Endpoint
- Anomalous usage of 7zip
- Citrix ADC Exploitation CVE-2023-3519
- Create Remote Thread into LSASS
- Create local admin accounts using net exe
- Detect Credential Dumping through LSASS access
- Detect New Local Admin account
- Detect Remote Access Software Usage DNS
- Detect Remote Access Software Usage File
- Detect Remote Access Software Usage Process
- Detect Remote Access Software Usage URL
- Detect SharpHound Command-Line Arguments
- Detect SharpHound File Modifications
- Disable Defender AntiVirus Registry
- Disabled Kerberos Pre-Authentication Discovery With Get-ADUser
- Domain Controller Discovery with Nltest
- [Elevated ...
v4.39.1
Release notes
- RMM Software Tracking Dashboard was missing in the 4.39.0 release. This has been resolved in Content Update 4.39.1.
v4.39.0
Key Highlights
Enterprise Security Content Update version 4.39.0 introduces critical detections aimed at addressing vulnerabilities in Ivanti Virtual Traffic Manager (CVE-2024-7593), with a particular focus on detecting SQL injection remote code execution and unauthorized account creation activities.This update also significantly enhances Office 365 security by incorporating advanced detections that monitor data loss prevention triggers, identify suspicious email behaviors, and track critical security feature changes across email and SharePoint environments, ensuring a more robust defense against potential threats. Additionally, a comprehensive set of new detections for Windows Active Directory is included, targeting potential threats related to privilege escalation, dangerous ACL modifications, GPO changes, and suspicious attribute modifications, thereby strengthening the overall identity and access management defenses within the enterprise. This release also introduces a new RMM Software Tracking Dashboard, designed to assist with the auditing and monitoring of Remote Monitoring and Management (RMM) software. This dashboard provides comprehensive visibility into RMM alert content, enabling more effective tracking and analysis of RMM-related activities and potential security risks within your environment.
New Analytic Story - [2]
New Analytics - [29]
- Detect Password Spray Attack Behavior From Source (External Contributor: @nterl0k )
- Detect Password Spray Attack Behavior On User(External Contributor: @nterl0k )
- Ivanti EPM SQL Injection Remote Code Execution
- Ivanti VTM New Account Creation
- O365 DLP Rule Triggered(External Contributor: @nterl0k )
- O365 Email Access By Security Administrator(External Contributor: @nterl0k )
- O365 Email Reported By Admin Found Malicious(External Contributor: @nterl0k )
- O365 Email Reported By User Found Malicious(External Contributor: @nterl0k )
- O365 Email Security Feature Changed(External Contributor: @nterl0k )
- O365 Email Suspicious Behavior Alert(External Contributor: @nterl0k )
- O365 Safe Links Detection(External Contributor: @nterl0k )
- O365 SharePoint Allowed Domains Policy Changed(External Contributor: @nterl0k )
- O365 SharePoint Malware Detection(External Contributor: @nterl0k )
- O365 Threat Intelligence Suspicious Email Delivered(External Contributor: @nterl0k )
- O365 Threat Intelligence Suspicious File Detected(External Contributor: @nterl0k )
- O365 ZAP Activity Detection(External Contributor: @nterl0k )
- Windows AD DCShadow Privileges ACL Addition(External Contributor: @dluxtron)
- Windows AD Dangerous Deny ACL Modification(External Contributor: @dluxtron)
- Windows AD Dangerous Group ACL Modification(External Contributor: @dluxtron)
- Windows AD Dangerous User ACL Modification(External Contributor: @dluxtron)
- Windows AD Domain Root ACL Deletion(External Contributor: @dluxtron)
- Windows AD Domain Root ACL Modification(External Contributor: @dluxtron)
- Windows AD GPO Deleted(External Contributor: @dluxtron)
- Windows AD GPO Disabled(External Contributor: @dluxtron)
- Windows AD GPO New CSE Addition(External Contributor: @dluxtron)
- Windows AD Hidden OU Creation(External Contributor: @dluxtron)
- Windows AD Object Owner Updated(External Contributor: @dluxtron)
- Windows AD Self DACL Assignment(External Contributor: @dluxtron)
- Windows AD Suspicious Attribute Modification(External Contributor: @dluxtron)
Updated Analytics - [2]
- Azure AD Concurrent Sessions From Different Ips
- Azure AD High Number Of Failed Authentications From Ip
New Dashboards
- RMM Software Tracking: Utilize this dashboard to assist with auditing and monitoring of Remote Monitoring and Management (RMM) alert content. (External Contributor: @nterl0k )
Other Updates
- Updated observables for 300+ analytics to improve creation accuracy of risk and threat objects
- contentctl was updated to v4.3.3, expanding the validation of content which leverages risk-based alerting (RBA). All production ESCU content, which uses RBA is now tested to ensure that threat objects, risk objects, and risk messages are generated accurately. These additional validations have resulted in the improvement of over 300 pieces of content in ESCU 4.39.0.
v4.38.0
Key highlights
Enterprise Security Content Update version 4.38.0 introduces new detections focusing on Windows Endpoints and Office365 with specific attention to identity and access management vulnerabilities. This version also includes detections to identify unusual NTLM authentication patterns. A number of new detections are included for Crowdstrike environments to identify weak password policies, detect duplicate passwords among users and administrators, assess identity risk with various severity levels, and detect privilege escalation attempts in non-administrative accounts. For Office 365 environments, this update includes detections to monitor cross-tenant access changes, external guest invitations, changes in external identity policies, and privileged role assignments. Finally, two new analytic stores are included for help detect Compromised Windows Hosts or activities linked to the Handala Wiper Malware.
New Analytic Story - [2]
Updated Analytic Story - [1]
New Analytics - [20]
- Crowdstrike Admin Weak Password Policy
- Crowdstrike Admin With Duplicate Password
- Crowdstrike High Identity Risk Severity
- Crowdstrike Medium Identity Risk Severity
- Crowdstrike Medium Severity Alert
- Crowdstrike Multiple LOW Severity Alerts
- Crowdstrike Privilege Escalation For Non-Admin User
- Crowdstrike User Weak Password Policy
- Crowdstrike User with Duplicate Password
- O365 Application Available To Other Tenants(External Contributor: @nterl0k )
- O365 Cross-Tenant Access Change (External Contributor: @nterl0k )
- O365 External Guest User Invited (External Contributor: @nterl0k )
- O365 External Identity Policy Changed(External Contributor: @nterl0k )
- O365 Privileged Role Assigned To Service Principal(External Contributor: @nterl0k )
- O365 Privileged Role Assigned(External Contributor: @nterl0k )
- Windows Multiple NTLM Null Domain Authentications(External Contributor: @nterl0k )
- Windows Unusual NTLM Authentication Destinations By Source(External Contributor: @nterl0k )
- Windows Unusual NTLM Authentication Destinations By User(External Contributor: @nterl0k )
- Windows Unusual NTLM Authentication Users By Destination(External Contributor: @nterl0k )
- Windows Unusual NTLM Authentication Users By Source(External Contributor: @nterl0k )
Updated Analytics - [13]
- Detect Regasm Spawning a Process
- Detect Regasm with Network Connection
- Detect Regasm with no Command Line Arguments
- Executables Or Script Creation In Suspicious Path
- Internal Horizontal Port Scan
- Linux c99 Privilege Escalation
- Powershell Windows Defender Exclusion Commands
- Suspicious Process File Path
- Windows AutoIt3 Execution
- Windows Data Destruction Recursive Exec Files Deletion
- Windows Gather Victim Network Info Through Ip Check Web Services
- Windows High File Deletion Frequency
- Windows Vulnerable Driver Installed
Macros Added - [3]
- crowdstrike_identities
- crowdstrike_stream
- ntlm_audit
Macros Updated - [1]
- linux_hosts
Lookups Updated - [1]
- privileged_azure_ad_roles
Other Updates
- Added new data_source objects
- Changes TA names in data sources to match the name in Splunk
- Updated TA version to match the latest (new check in contentctl)
- Add configuration file to Sysmon and Windows Event Code 4688
- Update analytic story on detections for Handala Wiper