Attributed metadata history

Release r2025-11-01

New Rules new: AWS Bucket Deleted new: AWS Console Login Monitoring new: AWS ConsoleLogin Failed Authentication new: AWS EnableRegion Command Monitoring new: AWS IAM user with Console Access Login Without MFA (#5074) new: AWS KMS Imported Key Material Usage new: AWS STS GetCallerIdentity Enumeration Via TruffleHog new: AWS VPC Flow Logs Deleted new: Audit Rules Deleted Via Auditctl new: BaaUpdate.exe Suspicious DLL Load new: FTP Connection Open Attempt Via Winscp CLI new: File Access Of Signal Desktop Sensitive Data new: GitHub Repository Archive Status Changed new: GitHub Repository Pages Site Changed to Public new: Hacktool - EDR-Freeze Execution new: IIS WebServer Log Deletion via CommandLine Utilities new: ISATAP Router Address Was Set new: Installation of WSL KaliLinux new: Kaspersky Endpoint Security Stopped Via CommandLine - Linux new: Linux Sudo Chroot Execution new: Mask System Power Settings Via Systemctl new: Non-Standard Nsswitch.Conf Creation - Potential CVE-2025-32463 Exploitation new: PUA - Restic Backup Tool Execution new: Potential Executable Run Itself As Sacrificial Process new: Potential Exploitation of GoAnywhere MFT vulnerability new: Potential Lateral Movement via Windows Remote Shell new: Python WebServer Execution - Linux new: RunMRU Registry Key Deletion new: RunMRU Registry Key Deletion - Registry new: Suspicious BitLocker Access Agent Update Utility Execution (#5502) new: Syslog Clearing or Removal Via System Utilities new: Unsigned or Unencrypted SMB Connection to Share Established new: WFP Filter Added via Registry new: WSL Kali Linux Usage new: WinRAR Creating Files in Startup Locations new: Winrs Local Command Execution new: Winscp Execution From Non Standard Folder Updated Rules update: ASLR Disabled Via Sysctl or Direct Syscall - Linux - Add sysctl option update: AWS Successful Console Login Without MFA - only alert on successful logins update: Account Tampering - Suspicious Failed Logon Reasons - add SubStatus field update: Blackbyte Ransomware Registry - move to rules-emerging-threats folder update: Local Accounts Discovery - add OriginalFileName field update: Modify System Firewall - add nftables delete/flush update: PFX File Creation - Enhance filters, metadata and logic update: Potential LSASS Process Dump Via Procdump - expand flags and service-names detection update: Potentially Suspicious JWT Token Search Via CLI - add selection for common search tools update: PowerShell Download Pattern - add powershell_ise update: Powershell Token Obfuscation - Powershell - Move to the TH folder in order to set the right FP expectations. update: Suspicious C2 Activities - update definition (#5142) update: Suspicious Process Suspension via WERFaultSecure through EDR-Freeze - refine image path logic and include OriginalFileName for improved rule accuracy update: Suspicious Startup Folder Persistence: add more suspicious extensions update: Use Short Name Path in Image - change detection logic structure update: WinRAR Execution in Non-Standard Folder - update PE metadata Removed / Deprecated Rules remove: Active Directory Parsing DLL Loaded Via Office Application - deprecated as this rule was triggered everytime any office app was opened remove: Azure Application Credential Modified - superseeded by cbb67ecc-fb70-4467-9350-c910bdf7c628 remove: PowerShell DownloadFile - Deprecated in favour of 3b6ab547-8ec2-4991-b9d2-2b06702a48d7 remove: Whoami Utility Execution - Deprecated in favor of 502b42de-4306-40b4-9596-6f590c81f073 Fixed Rules fix: Allow Service Access Using Security Descriptor Tampering Via Sc.EXE - filter hexnode fix: Alternate PowerShell Hosts - PowerShell Module - filter out more legit powershell host fix: Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE - remove + characters from selectors fix: CurrentVersion Autorun Keys Modification - Add more filters for OneDriverSetup.EXE fix: CurrentVersion NT Autorun Keys Modification - filter svchost making legitimate registry change fix: F

This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.