🚀 Key Highlights
🌐 Suspicious Network and Shell Activity 🌐
Introduced new analytics for browser-spawned Unix shells with external connections, uncommon and rare network connections from LOLBAS binaries, and suspicious Socat listener and remote TCP activity. This coverage helps defenders identify potential command execution, network tunneling, proxying, and command-and-control behavior originating from browsers or trusted system utilities.
🍎 macOS AppleScript and User Interaction 🍎
Added two macOS analytics covering AppleScript shell execution and compilation, as well as suspicious user prompts displayed through osascript. These detections improve visibility into script-based execution and potentially deceptive user interaction used to facilitate malicious activity on macOS endpoints.
🪟 Windows Account and Browser Activity 🪟
Expanded Windows coverage with detections for changes to built-in account names and execution of content copied from a browser. These analytics help identify account manipulation and suspicious execution workflows that may involve commands or payloads copied from web content.
🧩 SCCM Abuse Detection 🧩
Introduced two analytics focused on suspicious SCCM activity: DLL planting in the SMS Provider directory and abnormal child-process execution spawned by smsexec. This provides stronger visibility into potential abuse of SCCM components for execution, persistence, or lateral movement.
🔧 Cross-Platform Detection Refinements 🔧
Updated 18 analytics across Citrix, Windows, Linux, and macOS environments. The refinements improve coverage and detection fidelity for Citrix ADC exploitation, pipe-based execution, file and process activity, data destruction, Ghostscript exploitation, account creation, data chunking, network discovery, PowerShell, event-log manipulation, user and private-key discovery, credential access, and execution from suspicious paths.
🗂️ Detection and AI Risk Classification 🗂️
Together with NIST AI RMF Control Coverage dashboard, we’ve added the detection_subcategory_map and nist_ai_rmf_subcategories lookups to improve analytic categorization, detection metadata, and alignment with NIST AI Risk Management Framework subcategories.
New Analytics - [12]
- Cisco NVM - Browser Spawned Unix Shell with External Connection
- LOLBAS Network Connection On Uncommon Port
- LOLBAS Rare Network Connection
- Linux Crontab Enumeration
- MacOS AppleScript Shell Execution and Compilation
- MacOS Osascript Displaying Suspicious User Prompt
- Socat Network Listener Binding an Executable
- Socat Remote TCP Connection with Local Echo Disabled
- Windows Builtin Account Name Was Changed
- Windows Content Copied from Browser was Executed
- Windows SCCM Adsource DLL Was Planted In SMS Provider Directory
- Windows SCCM Smsexec Spawned a Suspicious Child Process
Updated Analytics - [18]
- Citrix ADC Exploitation CVE-2023-3519
- File Download or Read to Pipe Execution
- Icacls Deny Command
- Jscript Execution Using Cscript App
- Linux Data Destruction Command
- Linux Ghostscript Exploitation
- MacOS Account Created
- MacOS Data Chunking
- Network Connection Discovery With Arp
- PowerShell 4104 Hunting
- Suspicious wevtutil Usage
- System User Discovery With Whoami
- Windows CAB File on Disk
- Windows Private Keys Discovery
- Windows Process Execution in Temp Dir
- Windows Suspicious Process File Path
- Windows TinyCC Shellcode Execution
- Windows Unusual SysWOW64 Process Run System32 Executable
Other updates
- A new NIST AI RMF Control Coverage dashboard, available in alpha, maps AI-related ESCU detections and activity to the framework's Govern, Map, Measure, and Manage functions. This helps security teams identify coverage gaps and turn technical telemetry into clearer risk and governance insights.
- Two new lookups detection_subcategory_map, nist_ai_rmf_subcategories were added to support the NIST AI RMF Dashboard.
- A special thanks to @thegreatmhn and @munzzyy from the Security Content community for reporting bugs and proposing fixes that improved the quality and reliability of the security content.
Content Scheduled for Removal in Future Releases
| Content | Content Type | Removed in Version | Reason | Replacement Content |
|---|---|---|---|---|
| LOLBAS With Network Traffic | Detection | 6.8.0 | Detection deprecated due to high false positive rates from certain LOLBAS binaries with common legitimate network behavior. This broad analytic is being split into more manageable anomaly analytics with separate process groups and common-port tuning. | LOLBAS Network Connection On Uncommon Port, LOLBAS Rare Network Connection |
| Linux Adding Crontab Using List Parameter | Detection | 6.8.0 | Detection deprecated as its name and description are not matching the behavior of the search. The search is looking for crontab command with list parameter, not adding a new cron job. | Linux Crontab Enumeration |
