Attributed metadata history

v6.7.0

🚀 Key Highlights 🍎 Expanded macOS AppleScript and osascript coverage 🍎 Added three new macOS analytics that identify osascript executing interactive shells, JavaScript for Automation code using the Objective-C bridge, and long-lived network connections. This improves visibility into script-based execution, remote access, command-and-control activity, and post-exploitation behavior on macOS endpoints. 🪟 Windows ClickFix and LOLBin detection coverage 🪟 Added four new Windows analytics covering remote connections through finger.exe, command execution through for /f loops, JavaScript execution by node.exe from unusual directories, and processes accessing the IronLanguages repository on GitHub. Together, these detections improve visibility into ClickFix-related execution chains, payload retrieval, scripting abuse, and the use of trusted utilities for malicious activity. 🔐 Improved credential-access and process-injection detection 🔐 Updated multiple detections leveraging the process access data source, covering LSASS access and termination, credential dumping, Winlogon token manipulation, Rubeus ticket export activity, handle duplication, and process injection. These changes improve analytic consistency, investigation context, and visibility into credential-access and defense-evasion techniques. 🛠️ Detection quality and metadata improvements 🛠️ Updated multiple analytics across application, endpoint, network, and web content. Changes include improved SPL logic, additional threat objects and references, better event context, and tuning intended to improve detection fidelity and reduce noise. Updates include coverage for ESXi tampering and VM termination, event-log clearing, Kerberos coercion, internal network scanning, and suspicious HTTP activity. New Analytics - [7] Cisco NVM - Osascript Network Connection for a Long Duration MacOS Osascript Executing Interactive Shell MacOS Osascript Executing JavaScript Code With ObjC Windows Finger.exe Connecting to a Remote Host Windows For Loop Usage Within Cmd.exe To Execute Commands Windows Node.exe Executing JS Script In Immediate Folder Windows Process Accessing IronLanguages Repository On GitHub Updated Analytics - [30] Cisco IOS XE WebUI Programmatic Configuration Creation of lsass Dump with Taskmgr CrushFTP Authentication Bypass Exploitation CrushFTP Max Simultaneous Users From IP DNS Kerberos Coercion Detect Credential Dumping through LSASS access ESXi Audit Tampering ESXi Bulk VM Termination Email files written outside of the Outlook directory Internal Horizontal Port Scan NMAP Top 20 Log4Shell JNDI Payload Injection Attempt Log4Shell JNDI Payload Injection with Outbound Connection Nginx ConnectWise ScreenConnect Authentication Bypass Plain HTTP POST Exfiltrated Data Prohibited Network Traffic Allowed Rubeus Kerberos Ticket Exports Through Winlogon Access Suspicious wevtutil Usage Unusually Long Content-Type Length Windows Access Token Manipulation Winlogon Duplicate Token Handle Windows Access Token Winlogon Duplicate Handle In Uncommon Path Windows Eventlog Cleared Via Wevtutil Windows Handle Duplication in Known UAC-Bypass Binaries Windows Possible Credential Dumping Windows Process Injection into Commonly Abused Processes Windows Terminating Lsass Process Windows Unsecured Outlook Credentials Access In Registry Windows Unusual File Creation in Confluence Directory Windows Vulnerable Driver Installed Windows WMI Impersonate Token Windows Wermgr Alternate Data Stream in Temp Dir Other Updates A special thanks to @0x4D6174696E from the Security Content community for reporting a bug in on piece of content that improved the quality and reliability of the security content. Breaking Changes List of detections scheduled for removal in ESCU version 6.10.0 Following is a list of detections scheduled for removal in ESCU version 6.10.0: Content Content Type Removed in Version Reason Replacement Content MacOS - Re-opened Applications Detection 6.10.0 D

This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.