Attributed metadata history

v6.8.0

🚀 Key Highlights 🔐 Expanded Active Directory and Windows threat coverage 🔐 Added four analytics for KerberLoss SPN manipulation, ResetNightmare-related UPN changes, and Windows Defender artifacts associated with ShieldCrash. These detections help identify suspicious account changes and exploitation activity. 🪟 Consolidated renamed-binary detection 🪟 Added four lookup-backed analytics covering renamed command interpreters, LOLBAS binaries, popular third-party software, and Python binaries. This replaces multiple separate searches with a smaller set of detections. ☁️ Improved support for current security data sources ☁️ Updated Office 365 message trace analytics to support the Microsoft 365 Graph sourcetype while retaining legacy support. Updates also improve CrowdStrike FDR compatibility and refine Azure AD consent and WMI event subscription detections. 🛠️ Detection quality and content improvements 🛠️ Updated 121 analytics and four macros, and added three lookup sets. Changes span Active Directory, cloud, endpoint, Cisco NVM, and Cisco Secure Firewall content, improving data handling, investigation context, and content maintainability. New Analytics - [8] Windows AD Computer SPN Modified By User Account Windows AD SPN Unicode Collision Injection Windows AD User Suspicious UPN Change Windows Defender Intermediary Artifact Was Observed Windows Renamed Command Interpreter was Executed Windows Renamed LOLBAS Binary was Executed Windows Renamed Popular 3rd Party Software was Executed Windows Renamed Python Binary was Executed Updated Analytics - [121] 3CX Supply Chain Attack Network Indicators Attacker Tools On Endpoint Azure AD OAuth Application Consent Granted By User Azure AD Privileged Role Assigned to Service Principal Azure AD Privileged Role Assigned Azure AD User Consent Blocked for Risky Application Circle CI Disable Security Job Cisco NVM - Browser Spawned Unix Shell with External Connection Cisco NVM - Curl Execution With Insecure Flags Cisco NVM - Installation of Typosquatted Python Package Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI Cisco NVM - Non-Network Binary Making Network Connection Cisco NVM - Osascript Network Connection for a Long Duration Cisco NVM - Outbound Connection to Suspicious Port Cisco NVM - Rclone Execution With Network Activity Cisco NVM - Rundll32 Abuse of MSHTML.DLL for Payload Download Cisco NVM - Susp Script From Archive Triggering Network Activity Cisco NVM - Suspicious Download From File Sharing Website Cisco NVM - Suspicious File Download via Headless Browser Cisco NVM - Suspicious Network Connection From Process With No Args Cisco NVM - Suspicious Network Connection Initiated via MsXsl Cisco NVM - Suspicious Network Connection to IP Lookup Service API Cisco NVM - Webserver Download From File Sharing Website Cisco Secure Firewall - Binary File Type Download Cisco Secure Firewall - Blacklisted SSL Certificate Fingerprint Cisco Secure Firewall - File Download Over Uncommon Port Cisco Secure Firewall - Intrusion Events by Threat Activity Cisco Secure Firewall - Malware File Downloaded Cisco Secure Firewall - Remote Access Software Usage Traffic Cisco Secure Firewall - Repeated Malware Downloads Cloud API Calls From Previously Unseen User Roles Cloud Compute Instance Created By Previously Unseen User Cloud Compute Instance Created In Previously Unused Region Cloud Compute Instance Created With Previously Unseen Image Cloud Compute Instance Created With Previously Unseen Instance Type Cloud Instance Modified By Previously Unseen User Cloud Provisioning Activity From Previously Unseen City Cloud Provisioning Activity From Previously Unseen Country Cloud Provisioning Activity From Previously Unseen IP Address Cloud Provisioning Activity From Previously Unseen Region Common Ransomware Extensions Detect Remote Access Software Usage DNS Detect Remote Access Software Usage FileInfo Detect Remote Access Software Usage File Detect Remote Access Soft

This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.