These Release Notes document security content updates from content package c2112.2 which is included with Advanced Analytics i62.3. The Release Notes show the updates to content as compared to the previous content package c2204.3 which was released in i62.2.
The security content updates listed below include changes to the following areas:
In the lists below, each item represents a specific parser, model, or rule that has been added, updated, or deprecated. To facilitate finding every data source where the changed content items are referenced, a content library query has been created for each changed parser, model, or rule. To view the results of each query, click on the link for the relevant content item.
-
s-carbonblack-process-alert
-
s-okta-failed-login-3
-
A-FA-StartupFolder-OH – Hosts where programs were added to startup folders in the organization
-
A-RA-LogonRunKeys-OH – Hosts where programs add to the registry run keys in the organization.
-
A-WEB-Mime-Types-Src – Web Activity MIME types for asset in organization
-
FA-StartupFolder-OU – Users that add programs to the startup folders
-
RA-LogonRunKeys-OU – Users that add programs to the registry run keys
-
WEB-Mime-Types-Org – MIME types in the organization
-
A-EPA-CSC – Tracks csc activity for the asset.
-
A-EPA-OH-CENUM – Assets on which credential enumeration tools are run
-
A-EPA-OH-HENUM – Assets on which host enumeration tools are run
-
A-EPA-REG-WU – Models reg query activity for windows update on the assets.
-
A-FLDh-Count – Count of failed logons to host
-
A-NETFLOW-dZBytes – Inbound bytes per zone
-
A-NETFLOW-sH22Bytes – Outbound bytes through SSH protocol
-
A-NETFLOW-sH23Bytes – Outbound bytes through Telnet protocol
-
A-NETFLOW-sH25Bytes – Outbound bytes through SMTP protocol
-
A-NETFLOW-sH443Bytes – Outbound bytes through HTTPS protocol
-
A-NETFLOW-sH53Bytes – Outbound bytes through DNS protocol
-
A-NETFLOW-sH80Bytes – Outbound bytes through HTTP protocol
-
A-NETFLOW-sHFTPBytes – Outbound bytes through FTP protocol
-
AL-HT-EXEC – Executive Assets
-
DS-APRIV – Privileged user attributes
-
DS-OA – Non-privileged attributes in the organization
-
DS-UA – Attributes per privileged user
-
EM-EXEC – E-mail subjects sent by an executive user
-
FA-FT-EXEC – Executive Folders
-
WPA-PD – Directories per process
-
WPA-USH – Source hosts with privileged access events for user
There are no deprecated models in this release.
-
A-ALERT-Log4j – Alert associated with an exploitation or post exploitation as seen with Log4j Vulnerability was detected.
-
A-APP-Log4j-String – There was an attempt via app activity to exploit the CVE-2021-44228 vulnerability on this asset.
-
A-App-Log4j-String-2 – There was an attempt via app activity to exploit the CVE-2021-44228 vulnerability using known keywords on the asset.
-
A-EPA-HP-Commands-A – Abnormal execution of process on asset and the command of the process is curl/wget
-
A-EPA-HP-Commands-F – First execution of process on asset and the command of the process is curl/wget
-
A-EPA-HP-CrontabMod-A – Abnormal execution of process on asset and the command of the process is crontab modification
-
A-EPA-HP-CrontabMod-F – First execution of process on asset and the command of the process is crontab modification
-
A-EPA-Log4j-String-Command-2 – There was an attempt via process creation to exploit the CVE-2021-44228 vulnerability using known keywords on this asset.
-
A-EPA-Log4j-String-Command – There was an attempt via process creation to exploit the CVE-2021-44228 vulnerability on this asset.
-
A-FA-StartupFolder-OH-A – Abnormal addition of a program to the startup folder on the asset
-
A-FA-StartupFolder-OH-F – A program was added to the startup folder for the first time on this asset
-
A-KnownFirewallDisable-Log4j – FireWall disable arguments via command line were detected on this asset.
-
A-Log4j-Vul-Alert – Alert for the CVE-2021-44228 vulnerability on the asset.
-
A-NET-Log4j-IP – Asset was accessed by an external IP associated with Log4j exploit
-
A-NETF-Log4j-IP – There was a failed attempt to access this asset by an external IP associated with Log4j exploit
-
A-RA-LogonRunKeys-OH-A – Abnormal addition of a program to the registry run key on this asset
-
A-RA-LogonRunKeys-OH-F – A program was added to the registry run key on this asset at the first time
-
A-WEB-Base64CommandUserAgent – User agent with encoded commands was detected from this web activity.
-
A-WEB-Log4j-String-2 – There was an attempt via web activity to exploit the CVE-2021-44228 vulnerability using known keywords on the asset.
-
A-WEB-Log4j-String – There was an attempt via web activity to exploit the CVE-2021-44228 vulnerability on this asset.
-
A-WEB-Mime-Types-Org-F – First occurence of this mime type on this asset for organization
-
APP-Log4j-String-2 – There was an attempt via app activity to exploit the CVE-2021-44228 vulnerability using known keywords.
-
APP-Log4j-String – There was an attempt via app activity to exploit the CVE-2021-44228 vulnerability.
-
DLP-Log4j-String-2 – There was an attempt via email message to exploit the CVE-2021-44228 vulnerability using known keywords.
-
DLP-Log4j-String – There was an attempt via email message to exploit the CVE-2021-44228 vulnerability.
-
EPA-HP-Commands-F – First execution of process on host and the command of the process is curl/wget
-
EPA-Log4j-String-Command-2 – There was an attempt via process creation to exploit the CVE-2021-44228 vulnerability using known keywords.
-
EPA-Log4j-String-Command – There was an attempt via process creation to exploit the CVE-2021-44228 vulnerability by the user.
-
EPA-UP-Commands-A – Abnormal process execution containing wget or curl commands for the user.
-
EPA-UP-Commands-F – First execution of this process for user and the command of the process is curl/wget
-
EPA-UP-CrontabMod-A – Abnormal execution of of process which contains commands for crontab modification for user.
-
EPA-UP-CrontabMod-F – First execution of process which contains commands for crontab modification for user.
-
FA-StartupFolder-OU-A – Abnormal program addition to the startup folder by the user.
-
FA-StartupFolder-OU-F – A program was added to the startup folder for the first time by the user
-
Log4j-Vul-Alert – Alert for the CVE-2021-44228 vulnerability
-
RA-LogonRunKeys-OU-A – Abnormal addition of a program to the registry run key by the user
-
RA-LogonRunKeys-OU-F – A program was added to the registry run key for the first time by the user
-
WEB-Log4j-String-2 – There was an attempt via web activity to exploit the CVE-2021-44228 vulnerability using known keywords.
-
WEB-Log4j-String – There was an attempt via web activity to exploit the CVE-2021-44228 vulnerability.
-
WEB-Mime-Types-Org-F – First occurence of this mime type for organization
There are no updated rules in this release.
There are no deprecated rules in this release.