Skip to content

v3.21.0

Choose a tag to compare

View all tags
@josehelps josehelps released this 13 May 22:09
v3.21.0
2c1bc16
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.

New Analytic Stories

  • DarkSide Ransomware
  • Active Directory Password Spraying

New Detections

  • Extract SAM from Registry
  • SLUI RunAs Elevated
  • SLUI Spawning a Process
  • Detect Renamed RClone
  • Detect RClone Command-Line Usage
  • CMLUA Or CMSTPLUA UAC Bypass
  • Multiple Disabled Users Failing To Authenticate From Host Using Kerberos
  • Multiple Invalid Users Failing To Authenticate From Host Using Kerberos
  • Multiple Invalid Users Failing To Authenticate From Host Using NTLM
  • Multiple Users Attempting To Authenticate Using Explicit Credentials
  • Multiple Users Failing To Authenticate From Host Using Kerberos
  • Multiple Users Failing To Authenticate From Host Using NTLM
  • Multiple Users Failing To Authenticate From Process
  • Multiple Users Remotely Failing To Authenticate From Host
  • Delete ShadowCopy With PowerShell (Experimental)

Updated Detections

  • Ransomware Notes bulk creation
  • Cobalt Strike Named Pipes
Assets 3
Loading