Attributed metadata history
Up to 100 retained publisher events per page for 572439de62fc4c394c043990dbf38724eaf40c52ed7a421338637f09ee2f074c. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_457d9a43f60e7e15d0
observed · 2026-10-12 09:23:03 UTC
🚀 Key Highlights 🔐 Expanded Active Directory and Windows threat coverage 🔐 Added four analytics for KerberLoss SPN manipulation, ResetNightmare-related UPN changes, and Windows Defender artifacts associated with ShieldCrash. These detections help identify suspicious account changes and exploitation activity. 🪟 Consolidated renamed-binary detection 🪟 Added four lookup-backed analytics covering renamed command interpreters, LOLBAS binaries, popular third-party software, and Python binaries. This replaces multiple separate searches with a smaller set of detections. ☁️ Improved support for current security data sources ☁️ Updated Office 365 message trace analytics to support the Microsoft 365 Graph sourcetype while retaining legacy support. Updates also improve CrowdStrike FDR compatibility and refine Azure AD consent and WMI event subscription detections. 🛠️ Detection quality and content improvements 🛠️ Updated 121 analytics and four macros, and added three lookup sets. Changes span Active Directory, cloud, endpoint, Cisco NVM, and Cisco Secure Firewall content, improving data handling, investigation context, and content maintainability. New Analytics
Fingerprint: 0803b8ed8ef8d7c72c64e2b312cd73899d3b7fd5060fab951294c8f18052fed6
intelligence_src_457d9a43f60e7e15d0
observed · 2026-10-12 09:23:03 UTC
available
Fingerprint: 46a79d93330609014f09d35b0d753a3dee278bd71aaea4321313d2ee9c64a43c