5.2.0
Major Release: Upgrade Recommended
- Mechanism Improvements
- Refactored all built-in rules based on ATT&CK framework, adding labels, scoring, and threat levels
- Added automatic blocking mechanism based on IOA multi-step behavior
- Added automatic blocking mechanism based on scoring system
- Added stack detection to identify Direct Syscall, Indirect Syscall, and Shellcode calls
- Added UAC Bypass detection
- Added Keylogging detection
- Added asynchronous detection mechanism based on ETW-TI
- New Built-in Rules
- Global Trusted Modules
- Automatically Blocking Malicious Behaviors (IOA)
- Automatically Blocking Malicious Behaviors (Scoring)
- Automatically Allowing Anomalous Behaviors from High-Reputation Processes
- Automatically Blocking Suspicious Behaviors from Low-Reputation Processes
- Block modification of HVCI settings to intercept driver loading
- Lsass Hardening
- Block LOLBins Process Network Access
- Block Keylogging
- Block Browser Data and Password Theft
- Block UAC Elevation Bypass Exploits
- Block Exploits Leveraging System Mechanisms
- Block WDAC modifications
- Block DosDevices symbolic link modifications
- Block wow64log.dll hijacking
- Feature Optimizations
- Optimized process reputation mechanism
- Optimized injection detection mechanism
- Optimized process caching
Network Access Promptsupport allowing high-reputation processes- Prompt pop-ups now display TTP
- Other usability improvements
- Issue Fixes
- Fixed UI lag caused by driver blocking pop-ups in Windows 11, version 25H2
- Fixed various other reported issues