v4.31.0

New Analytic Story

Updated Analytic Story

New Analytics

• Windows Process Writing File to World Writable Path

Updated Analytics

• AWS Create Policy Version to allow all resources
• Detect Outbound SMB Traffic
• Detect Rare Executables
• Prohibited Network Traffic Allowed
• Remote Desktop Network Traffic
• Windows Masquerading Explorer As Child Process
• Recon AVProduct Through Pwh or WMI
• Detect Outbound SMB Traffic
• MSHTML Module Load in Office Product
• Office Document Creating Schedule Task
• Office Document Executing Macro Code
• Windows InstallUtil Credential Theft

Deprecated Analytics

• Windows DLL Search Order Hijacking Hunt with Sysmon

Other Updates

• Updated risk and threat related configurations for several detections
• Added Victims to missing detections to create correct risk_objects
• Converted 50+ Windows detections to leverage the XML log format

Upcoming Changes

IMPORTANT NOTE : In the upcoming v4.34.0 release, changes will be made to the security_content_summariesonly macro. Its current definition will change to wrap the existing values into another set of macros. This will allow each environment to customize each setting without changing the base macro. If this macro has already been modified in your environment, it will not be affected.