diff --git a/blog-cse/2025-10-10-content.md b/blog-cse/2025-10-10-content.md new file mode 100644 index 0000000000..41c1f517d0 --- /dev/null +++ b/blog-cse/2025-10-10-content.md @@ -0,0 +1,35 @@ +--- +title: October 10, 2025 - Content Release +image: https://assets-www.sumologic.com/company-logos/_800x418_crop_center-center_82_none/SumoLogic_Preview_600x600.jpg?mtime=1617040082 +keywords: + - log mappers +hide_table_of_contents: true +--- + +This content release includes: + - New and updated rules. + - Updated Threat Intelligence rules with match lists which can be populated with exclusions to prevent the generation of undesired signals. + - Mapping update. + +Changes are enumerated below. + +## Rules +- [New] CHAIN-S00023 Administrative Remote Interactive Brute Force Login +
This rule correlates a high number of failed authentication attempts with a successful remote interactive login (such as via RDP) coming from the same source IP address and user account. +- [New] CHAIN-S00024 RDP Brute Force Login Attempt +
This rule correlates a high number of failed authentication attempts with repeated inbound connections over port 3389 (the default RDP port). +- [New] MATCH-S01056 Administrative Remote Interactive Login +
This rule triggers on a successful remote interactive login (such as via RDP) of a privileged user. +- [Updated] MATCH-S00139 Abnormal Parent-Child Process Combination +
Updated to reduce false positive matches for certain parent-child process combinations. +- [Updated] MATCH-S01024 Threat Intel - Destination IP Address (High Confidence) +- [Updated] MATCH-S01026 Threat Intel - Destination IP Address (Low Confidence) +- [Updated] MATCH-S01028 Threat Intel - Destination IP Address (Medium Confidence) +- [Updated] MATCH-S01023 Threat Intel - Inbound Traffic from Threat Feed IP (High Confidence) +- [Updated] MATCH-S01025 Threat Intel - Inbound Traffic from Threat Feed IP (Low Confidence) +- [Updated] MATCH-S01027 Threat Intel - Inbound Traffic from Threat Feed IP (Medium Confidence) +- [Updated] MATCH-S01018 Threat Intel - Successful Authentication from Threat Feed IP + +## Log Mappers +- [Updated] Slack Anomaly Event +
Updated to include `threat_name` mapping for improved context in alerts. \ No newline at end of file