Security Content c2204.3 (i62.3) Release Notes

July 26, 2023 · View on GitHub

These Release Notes document security content updates from content package c2112.2 (i62.1 & i62.2) to c2204.3 (i62.3).

The security content updates listed below include changes to the following areas:

Parsers
Models
Rules

In the lists below, each item represents a specific parser, model, or rule that has been added, updated, or deprecated. To facilitate finding every data source where the changed content items are referenced, a content library query has been created for each changed parser, model, or rule. To view the results of each query, click on the link for the relevant content item.

New Parsers

Updated Parsers

Deprecated Parsers

s-carbonblack-process-alert
s-okta-failed-login-3

Models

New
Updated
Deprecated

New Models

A-FA-StartupFolder-OH – Hosts where programs were added to startup folders in the organization
A-RA-LogonRunKeys-OH – Hosts where programs add to the registry run keys in the organization.
A-WEB-Mime-Types-Src – Web Activity MIME types for asset in organization
FA-StartupFolder-OU – Users that add programs to the startup folders
RA-LogonRunKeys-OU – Users that add programs to the registry run keys
WEB-Mime-Types-Org – MIME types in the organization

Updated Models

A-EPA-CSC – Tracks csc activity for the asset.
A-EPA-OH-CENUM – Assets on which credential enumeration tools are run
A-EPA-OH-HENUM – Assets on which host enumeration tools are run
A-EPA-REG-WU – Models reg query activity for windows update on the assets.
A-FLDh-Count – Count of failed logons to host
A-NETFLOW-dZBytes – Inbound bytes per zone
A-NETFLOW-sH22Bytes – Outbound bytes through SSH protocol
A-NETFLOW-sH23Bytes – Outbound bytes through Telnet protocol
A-NETFLOW-sH25Bytes – Outbound bytes through SMTP protocol
A-NETFLOW-sH443Bytes – Outbound bytes through HTTPS protocol
A-NETFLOW-sH53Bytes – Outbound bytes through DNS protocol
A-NETFLOW-sH80Bytes – Outbound bytes through HTTP protocol
A-NETFLOW-sHFTPBytes – Outbound bytes through FTP protocol
AL-HT-EXEC – Executive Assets
DS-APRIV – Privileged user attributes
DS-OA – Non-privileged attributes in the organization
DS-UA – Attributes per privileged user
EM-EXEC – E-mail subjects sent by an executive user
FA-FT-EXEC – Executive Folders
WPA-PD – Directories per process
WPA-USH – Source hosts with privileged access events for user

Deprecated Models

There are no deprecated models in this release.

Rules

New
Updated
Deprecated

New Rules

A-ALERT-Log4j – Alert associated with an exploitation or post exploitation as seen with Log4j Vulnerability was detected.
A-APP-Log4j-String – There was an attempt via app activity to exploit the CVE-2021-44228 vulnerability on this asset.
A-App-Log4j-String-2 – There was an attempt via app activity to exploit the CVE-2021-44228 vulnerability using known keywords on the asset.
A-EPA-HP-Commands-A – Abnormal execution of process on asset and the command of the process is curl/wget
A-EPA-HP-Commands-F – First execution of process on asset and the command of the process is curl/wget
A-EPA-HP-CrontabMod-A – Abnormal execution of process on asset and the command of the process is crontab modification
A-EPA-HP-CrontabMod-F – First execution of process on asset and the command of the process is crontab modification
A-EPA-Log4j-String-Command-2 – There was an attempt via process creation to exploit the CVE-2021-44228 vulnerability using known keywords on this asset.
A-EPA-Log4j-String-Command – There was an attempt via process creation to exploit the CVE-2021-44228 vulnerability on this asset.
A-FA-StartupFolder-OH-A – Abnormal addition of a program to the startup folder on the asset
A-FA-StartupFolder-OH-F – A program was added to the startup folder for the first time on this asset
A-KnownFirewallDisable-Log4j – FireWall disable arguments via command line were detected on this asset.
A-Log4j-Vul-Alert – Alert for the CVE-2021-44228 vulnerability on the asset.
A-NET-Log4j-IP – Asset was accessed by an external IP associated with Log4j exploit
A-NETF-Log4j-IP – There was a failed attempt to access this asset by an external IP associated with Log4j exploit
A-RA-LogonRunKeys-OH-A – Abnormal addition of a program to the registry run key on this asset
A-RA-LogonRunKeys-OH-F – A program was added to the registry run key on this asset at the first time
A-WEB-Base64CommandUserAgent – User agent with encoded commands was detected from this web activity.
A-WEB-Log4j-String-2 – There was an attempt via web activity to exploit the CVE-2021-44228 vulnerability using known keywords on the asset.
A-WEB-Log4j-String – There was an attempt via web activity to exploit the CVE-2021-44228 vulnerability on this asset.
A-WEB-Mime-Types-Org-F – First occurence of this mime type on this asset for organization
APP-Log4j-String-2 – There was an attempt via app activity to exploit the CVE-2021-44228 vulnerability using known keywords.
APP-Log4j-String – There was an attempt via app activity to exploit the CVE-2021-44228 vulnerability.
DLP-Log4j-String-2 – There was an attempt via email message to exploit the CVE-2021-44228 vulnerability using known keywords.
DLP-Log4j-String – There was an attempt via email message to exploit the CVE-2021-44228 vulnerability.
EPA-HP-Commands-F – First execution of process on host and the command of the process is curl/wget
EPA-Log4j-String-Command-2 – There was an attempt via process creation to exploit the CVE-2021-44228 vulnerability using known keywords.
EPA-Log4j-String-Command – There was an attempt via process creation to exploit the CVE-2021-44228 vulnerability by the user.
EPA-UP-Commands-A – Abnormal process execution containing wget or curl commands for the user.
EPA-UP-Commands-F – First execution of this process for user and the command of the process is curl/wget
EPA-UP-CrontabMod-A – Abnormal execution of of process which contains commands for crontab modification for user.
EPA-UP-CrontabMod-F – First execution of process which contains commands for crontab modification for user.
FA-StartupFolder-OU-A – Abnormal program addition to the startup folder by the user.
FA-StartupFolder-OU-F – A program was added to the startup folder for the first time by the user
Log4j-Vul-Alert – Alert for the CVE-2021-44228 vulnerability
RA-LogonRunKeys-OU-A – Abnormal addition of a program to the registry run key by the user
RA-LogonRunKeys-OU-F – A program was added to the registry run key for the first time by the user
WEB-Log4j-String-2 – There was an attempt via web activity to exploit the CVE-2021-44228 vulnerability using known keywords.
WEB-Log4j-String – There was an attempt via web activity to exploit the CVE-2021-44228 vulnerability.
WEB-Mime-Types-Org-F – First occurence of this mime type for organization

Updated Rules

There are no updated rules in this release.

Deprecated Rules

There are no deprecated rules in this release.