Home Original page

Releases · splunk/security_content

v5.25.0

🚀 Key Highlights

  • Ghost RAT: Expanded coverage for Ghost RAT activity by tagging multiple existing analytics related to service creation, registry persistence, command-line execution, and system discovery behaviors, alongside new detections for Windows Remote Access Registry Entry and Windows Rundll32 with Non-Standard File Extension. Additionally, improved detection fidelity with updates to Ping Sleep Batch Command and introduced a new analytic story Ghost RAT, enhancing visibility into stealthy persistence, defense evasion, and command execution techniques commonly used by this malware family.
  • Void Manticore Activity Coverage Expansion: Expanded detection coverage for Void Manticore, a threat group associated with destructive and espionage-driven operations, by tagging multiple existing analytics aligned to data destruction, shadow copy deletion, backup recovery tampering, and suspicious script execution behaviors. This update enhances visibility into attacker tradecraft involving bcdedit manipulation, recursive file deletion, remote process execution via WMI, and suspicious process/file activity, improving detection of pre-impact and impact-stage techniques commonly used in disruptive campaigns targeting enterprise environments.
  • Detection & Content Improvements: Introduced new data source support, migrated Palo Alto integrations, enhanced detections with MITRE mappings, fixed regex and logic issues, reduced false positives, improved accuracy and performance, updated metadata based on telemetry insights, and refactored multiple analytics and SPL queries for better readability, consistency, and reliability

New Analytic Story - [2]

New Analytics - [2]

Updated Analytics

Based on various other telemetry sources, we have updated a list of detections missing Mitre IDs, updated data sources and detections with the following changes:

v5.24.0

🚀 Key Highlights

  • Cisco SD-WAN Analytics: Expanded coverage for Cisco SD-WAN environments with new analytics targeting exploitation and anomalous traffic patterns, including detections for Cisco SD-WAN Arbitrary File Overwrite Exploitation Activity and Cisco SD-WAN Uncommon User-Agent Multi-URI Activity, improving visibility into potential exploitation attempts and suspicious HTTP behaviors indicative of adversary interaction with SD-WAN infrastructure.
  • BlankGrabber Stealer and Muddy Water Analytics: Expanded detection coverage for BlankGrabber, a Windows-based information stealer used to harvest browser credentials, cryptocurrency wallets, and authentication tokens, by tagging existing analytics and introducing new detections focused on browser data access, suspicious registry queries, WMI reconnaissance, and defense evasion behaviors such as PowerShell exclusion tampering. This update enhances visibility into credential harvesting, data staging, and stealthy exfiltration activity commonly associated with phishing-delivered stealers and cracked software infections, helping defenders detect and respond to early-stage compromise before widespread account takeover or financial theft occurs.
  • Lotus Blossom (Chrysalis Backdoor) Supply Chain Attack: Added new detection coverage for the Lotus Blossom (Billbug) APT group's Chrysalis backdoor campaign, which leveraged a Notepad++ supply chain compromise (June–December 2025) to target government, financial, and IT sectors. This release introduces detections for Bitdefender DLL sideloading abuse, BluetoothService-based persistence, and TinyCC shellcode execution, along with tagging existing analytics for system and user discovery behaviors observed across multiple infection chains. These updates improve visibility into stealthy execution, persistence mechanisms, and post-compromise reconnaissance associated with sophisticated supply chain intrusions and staged payload delivery.
  • Standardized Risk Scoring Across Detections: Implemented consistent risk scoring across all analytics by assigning a score of 50 for TTP detections and 20 for anomaly-based detections, improving prioritization, correlation, and alert triage across detection workflows.

New Analytic Story - [4]

Updated Analytic Story - [1]

New Analytics - [14]

Updated Analytics - [1655]

Read more

v5.23.0

🚀 Key Highlights

  • 🤖 Cisco Catalyst SD-WAN Analytics:

Introduced a new analytic story for Cisco Catalyst SD-WAN focused on identifying anomalous control-plane relationships across vManage, vSmart, and edge devices. By leveraging telemetry related to control-connection state changes, peer identity, public IP associations, and system roles, this release detects rare or unexpected peer interactions that may signal misconfigurations, unauthorized infrastructure, or adversary presence within SD-WAN environments. New detections — Cisco SD-WAN Low Frequency Rogue Peer and Cisco SD-WAN Peering Activity — provide visibility into suspicious control-plane communications and abnormal peering patterns that deviate from established network baselines.

New Analytic Story - [1]

New Analytics - [3]

Other Updates

  • Added end-to-end YAML formatting/validation (yamlfmt + yamllint) via a new pre-commit hook and CI “YAML Validation” job (validate_yaml.py), updates docs, and auto-formats all detections/analytics (including initial SPL beautification using |- for readability).
  • Updates multiple detections to better cover calc-related binaries by adding CalculatorApp.exe/win32calc.exe entries, fixing a LOLBAS network-traffic filter bug (All_Traffic.dest_ip), and enhancing calc DLL side-loading rule metadata (including explicit WindowsCodecs.dll) to address issue #3916.

v5.22.0

🚀 Key Highlights

  • 🤖 Suspicious MCP Activities:
    Introduced a new analytic story focused on detecting abuse of authorized Model Context Protocol (MCP) server deployments, where legitimate AI tool integrations (filesystem, database, API, and cloud operations) may be weaponized for data exfiltration, privilege escalation, lateral movement, or persistence. This release includes a new MCP Technology Add-on (TA) for parsing MCP server telemetry and adds detections such as MCP Sensitive System File Search, MCP Prompt Injection, MCP Postgres Suspicious Query, MCP GitHub Suspicious Operation, and MCP Filesystem Server Suspicious Extension Write, providing visibility into malicious tool invocation patterns, abnormal data access, and AI-driven attack chains leveraging trusted automation infrastructure.

  • 💥 DynoWiper and ZOVWiper (Sandworm Destructive Operations):
    Expanded coverage for the destructive malware families DynoWiper and ZOVWiper, attributed to the Russia-aligned threat group Sandworm, by tagging existing endpoint analytics aligned to their file-overwrite, drive enumeration, and system reboot behaviors. These wipers target critical infrastructure and financial sectors, systematically overwriting data across fixed and removable drives while selectively skipping system directories to maximize operational impact. By mapping current detections to known Sandworm tradecraft, this update strengthens visibility into destructive file modification patterns, large-scale overwrite activity, and pre-reboot execution behaviors associated with modern wiper deployments.

  • ☀️ SolarWinds Web Help Desk RCE (CVE-2025-26399) Post-Exploitation:
    Tagged existing analytics to enhance visibility into post-exploitation activity following SolarWinds WHD remote code execution, focusing on suspicious process spawning, privilege escalation, lateral movement, persistence mechanisms, and outbound command-and-control behavior originating from compromised Web Help Desk services.

New Analytic Story - [5]

New Analytics - [7]

Updated Analytics

Breaking Changes

As previously communicated in the ESCU v5.20.0 release, several detections have been removed. For a complete list of the detections removed in version v5.22.0, refer to the List of Removed Detections. Users are expected to transition to the recommended replacements where applicable. Additionally, a new set of detections has been deprecated. For details on detections scheduled for removal in ESCU version v5.24.0, see the List of Detections Scheduled for Removal.

Removed Detection Replacement Detection
Cobalt Strike Named Pipes Windows Suspicious C2 Named Pipe
HTTP Suspicious Tool User Agent HTTP Scripting Tool User Agent

v5.21.0

🚀 Key Highlights

  • 🔍 New Finding-Based Detections (ES 8.4+):
    Starting with Splunk Enterprise Security 8.4 and above, ESCU introduces Finding-Based Detections, a new analytic type that automatically groups and correlates high volumes of related findings and intermediate at the entity level. This reduces alert noise and helps analysts quickly focus on users or hosts most likely to represent real threats.

  • 🛡️ GNU Telnetd CVE-2026-24061 Authentication Bypass:
    Introduced a new analytic story covering CVE-2026-24061, a critical authentication bypass vulnerability in GNU InetUtils telnetd that allows unauthenticated attackers to establish a Telnet session as root. This flaw abuses an unsanitized, attacker-controlled USER environment variable passed to the login process, enabling direct privilege escalation without valid credentials. Added a new detection — Linux Telnet Authentication Bypass — to identify exploitation attempts targeting legacy Unix/Linux systems, embedded devices, network appliances, and operational technology environments where Telnet remains in use.

  • 🌐 Windows Chromium Browser Hijacking Enhancements:
    Expanded browser hijacking coverage with new endpoint detections targeting suspicious Chromium-based browser execution patterns on Windows. Added analytics to identify browsers launched with abnormally small window sizes, disabled popup blocking, disabled logging, suppressed extensions, and headless execution — behaviors commonly associated with ad fraud, credential harvesting, session hijacking, and stealthy user interaction abuse. These detections improve visibility into malicious browser manipulation used by infostealers, loaders, and post-exploitation frameworks.

  • 🎯 Expanded Threat Actor and Malware Coverage (VoidLink, Storm-0501, StealC):
    Tagged a broad set of existing analytics and improved detection coverage for several high-impact threats. Added comprehensive coverage for VoidLink, a cloud-native Linux malware framework leveraging a modular C2 architecture, rootkit functionality, and advanced evasion techniques to target containerized and cloud environments. Additionally, enhanced analytic stories and tagging for Storm-0501 ransomware activity and the StealC stealer, improving visibility into ransomware execution chains, credential theft, downloader behavior, and post-compromise persistence across Windows and Linux environments.

Total New and Updated Content: [419]

New Analytic Story - [4]

Updated Analytic Story - [6]

Updated Analytics -[6]

Breaking Changes

Other Updates

  • Updated several analytics and significantly improved performance and efficiency across multiple detections by optimizing search logic (e.g., subsearches, targeted where clauses, and reduced search space), resulting in substantial runtime reductions and clearer user guidance where applicable. Pull request for specific details (#1 and #2)
  • Updated analytics to have standardized known false positive sections and filter macros at the end of all searches
  • We received reports from a number of customers whereby Removed Searches may still be scheduled to run and their execution would fail silently. However, these searches could not be disabled because they failed to render in the Saved Searches UI. This release includes a fix to savedsearches.conf which ensures that Removed Content still appears in the SavedSearches UI if it had previously been scheduled or modified, allowing these searches to be disabled.

v5.20.0

🚀 Key Highlights

  • 🌐 Browser Hijacking:
    Introduced a new set of detections focused on browser hijacking techniques that manipulate Chrome configurations, registry settings, and command-line behaviors to persist malicious control, disable updates, and load unauthorized extensions. These detections surface suspicious actions such as disabling Chrome auto-updates, allowlisting or force-loading extensions, and abusing command-line flags to bypass browser security controls. Together, they help security teams identify early indicators of browser compromise, policy tampering, and user-impacting persistence mechanisms commonly leveraged by modern malware.

  • ☸️ Cisco Isovalent Suspicious Activity:
    Expanded detection coverage leveraging Cisco Isovalent's kernel-level eBPF telemetry to identify advanced threats targeting Kubernetes and cloud-native environments. New detections focus on high-risk behaviors such as access to cloud metadata services, suspicious process execution, container escape techniques, offensive tooling in pods, anomalous kprobe activity, and unexpected shell or network behavior. By correlating low-level runtime signals with rich Kubernetes context, this content enables early detection of in-cluster attacks, lateral movement, and workload compromise before adversaries can escalate or persist.

  • 🕵️ Suspicious User Agents:
    Introduced enhanced detection coverage to identify suspicious and default user agent strings commonly used by malware, command-and-control frameworks, remote monitoring and management (RMM) tools, and other potentially unwanted applications. These detections focus on uncovering overlooked or hard-coded user agents frequently left unchanged by adversaries, providing network-level visibility into malicious tooling that blends into normal HTTP traffic. By correlating anomalous user agents across malware, C2 frameworks, PUAs, and RMM software, security teams can more quickly identify and investigate stealthy network activity.

  • 🤖 SesameOp & PromptFlux:
    Expanded analytic coverage for emerging malware families that abuse legitimate AI service APIs as command-and-control channels, allowing adversaries to hide malicious activity within trusted cloud traffic. This update tags relevant existing detections and introduces a new detection for Windows Potential AppDomainManager Hijack Artifacts Creation, addressing key persistence and injection techniques leveraged by SesameOp and PromptFlux. Together, these detections help surface anomalous API usage, suspicious persistence artifacts, and post-exploitation behaviors that indicate covert C2 activity masquerading as normal AI service interactions.

  • 🔐 Cisco IOS & Secure Firewall Privileged Activity:
    Added new detections and risk-based correlation searches to identify high-risk administrative activity targeting Cisco IOS and Cisco Secure Firewall devices. The new detections focus on privileged command execution over HTTP and anomalous SSH behavior, including connections to non-standard ports and suspicious SSH services. These signals are correlated using the Risk data model to surface higher-fidelity alerts for privileged account creation combined with suspicious HTTP or SSH activity, helping teams identify post-exploitation and persistence attempts on network edge infrastructure.

New Analytic Story - [5]

New Analytics - [25]

Other Updates

  • Performance & Coverage Improvements – Updated several searches by replacing regex-based matching with direct match driven comparisons to significantly improve performance and scalability in large environments, while also refreshing multiple lookup files to ensure accurate and up-to-date detection logic

Breaking Changes

As previously communicated in ESCU v5.18.0, several detections have been removed in v5.20.0:

Removed Detection Replacement Detection
Windows Default RDP File Creation Windows Default RDP File Creation By Non MSTSC Process
Windows Java Spawning Shells Web or Application Server Spawning a Shell
Linux Java Spawning Shell Web or Application Server Spawning a Shell
W3WP Spawning Shell Web or Application Server Spawning a Shell
Wget Download and Bash Execution File Download or Read to Pipe Execution
Curl Download and Bash Execution File Download or Read to Pipe Execution
Wmiprsve LOLBAS Execution Process Spawn Wmiprvse LOLBAS Execution Process Spawn

v5.19.0

🚀 Key Highlights

  • 🐚 React2Shell (CVE-2025-55182):
    Introduced a new analytic story, React2Shell, addressing the critical pre-authentication Remote Code Execution (RCE) vulnerability in React Server Components. This vulnerability affects React versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, as well as Next.js 15.x and 16.x versions using the App Router. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints, allowing attackers to execute arbitrary JavaScript code on the server without authentication.
    New detections provide coverage for both Windows and Linux environments, focusing on suspicious child processes spawned by Node.js, React, or Next.js server processes, including execution of shells, scripting interpreters, and system utilities commonly abused post-exploitation. Additionally, a network-based detection leverages Cisco Secure Firewall Threat Defense Intrusion Events, which identifies React Server Components remote code execution attempts at the network layer, providing early visibility into exploitation attempts.

  • 👾 Tuoni C2 Framework:
    Introduced a new analytic story addressing threats from the Tuoni command-and-control framework, a sophisticated cross-platform red teaming tool increasingly adopted by threat actors for real-world attacks. Tuoni enables adversaries to deploy malicious payloads directly into system memory, bypassing traditional disk-based detection mechanisms. Its modular design supports multiple attack variations and allows operators to maintain persistence and execute commands across Windows, Linux, and macOS environments without leaving significant forensic artifacts. New detections focus on identifying Tuoni's memory-based execution patterns, suspicious process behaviors, and command-and-control communication indicators commonly associated with this framework, providing security teams with visibility into attacks that leverage this emerging threat tool.

  • 🔐 Kerberos Coercion with DNS (CVE-2025-33073):
    Introduced comprehensive detection coverage for the recently disclosed CVE-2025-33073 vulnerability, where attackers leverage DNS records to trigger Kerberos authentication from remote hosts—a technique that can lead to credential relay or domain privilege escalation. New detections including Windows Short-Lived DNS Record, Windows Kerberos Coercion via DNS, Windows Credential Target Information Structure in Command Line, and DNS Kerberos Coercion provide end-to-end visibility into DNS-based coercion behaviors across authentication and name resolution events, enabling SOCs to identify identity coercion attacks that often unfold silently inside Active Directory environments.

  • 📦 NPM Supply Chain Compromise (Shai-Hulud Campaigns):
    Expanded detection coverage for npm ecosystem supply chain compromises, addressing both the Shai-Hulud 2.0 worm campaign and recurring lifecycle hook abuse patterns. Added analytics to detect malicious npm package installations that execute arbitrary scripts through preinstall, install, postinstall, or prepare hooks—a long-standing risk vector exploited in major incidents from event-stream (2018) to ua-parser-js (2021) and Shai-Hulud (2025). New detections monitor GitHub workflow tampering, credential theft, and cross-platform exfiltration behaviors that often unfold silently inside CI/CD pipelines, giving defenders early visibility into malicious package lifecycle hooks and enhancing the ability to detect supply chain compromise before widespread impact.

  • 🖥️ NetSupport RMM Tool Abuse:
    Strengthened detection coverage for malicious use of the NetSupport Manager RMM tool, which adversaries frequently deploy for covert remote access under the guise of legitimate remote-support activity. New analytics identify NetSupport's presence through loaded module patterns, executable masquerading, and registry manipulation, helping distinguish authorized IT administration from unauthorized NetSupport-based intrusions involving renamed binaries, PowerShell-assisted deployment, suspicious startup locations, and stealthy remote control sessions. These detections complement updated credential-theft coverage to surface cases where NetSupport is deployed as part of a broader credential access or persistence chain.

  • 🤖 Suspicious Local LLM Frameworks (Shadow AI):
    Added new analytics to address the rise of Shadow AI—unauthorized deployment of local Large Language Model (LLM) frameworks such as Ollama, LM Studio, GPT4All, Jan, llama.cpp, and KoboldCPP inside enterprise environments. These tools allow users to run powerful models locally, creating blind spots for data exfiltration, policy violations, and unmonitored processing of sensitive information. New detections monitor model file downloads (.gguf, .ggml, safetensors), suspicious process execution, and DNS lookups to model repositories, providing defenders with early warning before unmonitored AI runtimes become channels for data exposure or endpoint abuse.

  • 🔥 Suspicious Cisco ASA Activity:
    Expanded detection coverage for malicious or unauthorized activity on Cisco Adaptive Security Appliances (ASA), representing the most extensive set of Cisco ASA security analytics released to date. New detections focus on configuration tampering, credential misuse, and covert administrative behaviors often seen in targeted network compromise and firewall takeover scenarios. Analytics surface high-risk events including AAA policy modification, logging filter tampering, logging message suppression, packet capture activation, and device file copy operations—both locally and to remote destinations. Additional detections highlight identity-based abuse such as new local user account creation, user deletion, privilege level changes, and lockout threshold anomalies, along with reconnaissance command usage that may reveal adversary staging or pre-attack mapping. By bringing ASA telemetry into the same analytic ecosystem as NVM, FTD, Duo, Umbrella, and Talos-driven rapid responses, this update enhances visibility into attempts to weaken audit controls, establish persistence, exfiltrate configuration data, or manipulate security boundaries on Cisco ASA devices.

New Analytic Story - [6]

New Analytics - [31]

Read more

v5.18.0

🚀 Key Highlights

  • 🐀 Castle RAT:
    Expanded coverage for the Castle RAT remote access trojan, which enables adversaries to execute commands, exfiltrate files, log keystrokes, and capture screens during targeted intrusion campaigns. Tagged multiple existing detections related to persistence, task creation, and suspicious process behavior, and introduced new analytics for unusual browser flag launches, ComputerDefaults-based UAC bypass, and handle duplication in known bypass binaries to improve visibility into Castle RAT infection chains, privilege escalation, and long-term access mechanisms.

  • 🌐 Research site enhancements:
    We’re excited to also announce that we’ve enhanced research.splunk.com to provide deeper insights and richer context for detection engineers. Each detection entry now includes detailed attack data along with corresponding MITRE ATT&CK techniques, the environment used to generate the data, timestamps of simulated attacks, and tools leveraged during simulation. You can also explore step-by-step details on how to replay these attacks within your own Splunk environment for validation, tuning, and testing. This update is designed to help you better understand adversary behaviors, validate your detections with real-world data, and accelerate the development of high-fidelity detections. We highly recommend checking out the enhanced experience at https://research.splunk.com/attack_data and leveraging this data to strengthen your detection engineering workflows.

New Analytic Story - [1]

New Analytics - [3]

Other Updates

  • Tagged several other detection analytics to Castle RAT
  • Updated the Splunkbase link for the Ollama TA data source and TA versions of various data sources

🔴 BREAKING CHANGES:

  • As previously communicated in the ESCU v5.16.0 release, several detections have been removed. For a complete list of the detections removed in version v5.18.0, refer to the List of Removed Detections. Users are expected to transition to the recommended replacements where applicable. Additionally, a new set of detections has been deprecated. For details on detections scheduled for removal in ESCU version v5.20.0, see the List of Detections Scheduled for Removal
Removed Detection Replacement Detection
Windows Change Default File Association For No File Ext Windows Change File Association Command To Notepad
Detect Rundll32 Application Control Bypass - setupapi Windows Application Whitelisting Bypass Attempt via Rundll32
Detect Rundll32 Application Control Bypass - syssetup Windows Application Whitelisting Bypass Attempt via Rundll32
Detect Rundll32 Application Control Bypass - advpack Windows Application Whitelisting Bypass Attempt via Rundll32

v5.17.0

🚀 Key Highlights

  • 🧩 Microsoft WSUS CVE-2025-59287 Remote Code Execution:
    Introduced a new analytic story for the exploitation of CVE-2025-59287, a critical WSUS deserialization vulnerability enabling unauthenticated remote code execution. Added a new detection — Windows WSUS Spawning Shell — and tagged related process-based detections to enhance post-exploitation visibility.

  • 🛡️ Oracle E-Business Suite Exploitation (TALOS Collaboration):
    Released new Snort-based detections developed with Cisco Talos to identify exploitation attempts against Oracle E-Business Suite. These analytics detect anomalous web requests, payload delivery, and lateral movement behaviors targeting enterprise ERP systems based on Snort alerts.

  • 🌐 HTTP Request Smuggling:
    Introduced a new analytic story to detect and investigate HTTP request smuggling techniques that exploit discrepancies in how web servers and proxies handle request sequences. Added detections — HTTP Suspicious Tool User Agent, HTTP Request to Reserved Name, HTTP Rapid POST with Mixed Status Codes, HTTP Possible Request Smuggling, and HTTP Duplicated Header — leveraging searches for indicators like CL.TE, TE.TE, and CL.0 to identify abuse of HTTP parsing logic and potential security control bypasses.

  • 💀 Scattered Lapsus$ Hunters and Hellcat Ransomware:
    Tagged a broad set of existing TTPs and added new analytic stories covering the Scattered Lapsus$ Hunters coalition (Scattered Spider, Lapsus$, and Shiny Hunters) and the Hellcat Ransomware RaaS group. These updates enhance visibility into MFA bypass, credential theft, remote access tool abuse, PowerShell infection chains, SSH persistence, and custom ransomware payloads targeting critical infrastructure, telecom, and government sectors.

New Analytic Story - [5]

New Analytics - [18]

Other Updates

  • Added new and updated several detections for which Github issues were reported. Please view this complete list of updates that are made to address false positives, efficiency and improved detection logic and names. Following are the details about the breaking changes

🔴 BREAKING CHANGES :

  • We have deprecated some detections that are scheduled to be removed in 5.20.0 and will be replaced with the following. It is highly recommended to following the deprecated process here to ensure that the detections continue running reliably,

a. Windows Change Default File Association For No File Ext
-> Replacement - Windows Change File Association Command To Notepad
b. Detect Rundll32 Application Control Bypass - setupapi
-> Replacement - Windows Application Whitelisting Bypass Attempt via Rundll32
c. Detect Rundll32 Application Control Bypass - syssetup
-> Replacement - Windows Application Whitelisting Bypass Attempt via Rundll32
d. Detect Rundll32 Application Control Bypass - advpack
-> Replacement - Windows Application Whitelisting Bypass Attempt via Rundll32

v5.16.0

🚀 Key Highlights

🦙 Suspicious Ollama Activities : Introduced a new analytic story focused on monitoring misuse and abuse of locally hosted LLMs through Ollama. This story includes detections such as Abnormal Network Connectivity, Service Crash or Availability Attack, Excessive API Requests, API Endpoint Scan Reconnaissance, Memory Exhaustion Resource Abuse, Model Exfiltration or Data Leakage, RCE via Model Loading, and Suspicious Prompt Injection or Jailbreak. A dedicated TA-Ollama is developed to parse Ollama server logs, enabling precise detection of adversarial prompt engineering, local model abuse, and AI-powered lateral movement scenarios.

✈️ Suspicious Microsoft 365 Copilot Activities : Added a new analytic story targeting emerging risks in GenAI integration with Microsoft 365 Copilot. Detections include M365 Copilot Application Usage Pattern Anomalies, Failed Authentication Patterns, Non-Compliant Devices Accessing Copilot, and Session Origin Anomalies. These analytics help security teams identify compromised identities, unauthorized device access, and abnormal usage trends associated with enterprise AI assistants.

🔒LokiBot and PromptLock Malware: Expanded coverage for LokiBot, a pervasive credential-stealing Trojan distributed via phishing and malicious attachments. A new detection (Windows Visual Basic Command-Line Compiler DNS Query) was added alongside enhanced tagging across related analytics to better identify suspicious DNS communications and data exfiltration attempts.

In addition, we introduced coverage for PromptLock, the first known GenAI-driven ransomware proof-of-concept discovered by ESET in 2025. PromptLock leverages a local AI model (gpt-oss:20b) via the Ollama API to dynamically generate Lua scripts for multi-platform encryption and exfiltration. These detections focus on anomalous AI invocation patterns, file encryption activity, and use of local LLM APIs for malicious automation.

👻 APT37 (Rustonotto & FadeStealer) and GhostRedirector: Expanded coverage for APT37, adding a new detection for suspicious Windows Cabinet file extraction activity linked to their Rustonotto and FadeStealer toolsets. This update enhances visibility into phishing-based infections, persistence mechanisms, and data exfiltration behavior.
Also introduced a new GhostRedirector and Rungan analytic story to track server compromises involving malicious IIS modules, SQL injection abuse, and stealthy PowerShell activity used to maintain access and manipulate web traffic.

These additions strengthen security teams' ability to detect and respond to emerging threats across critical enterprise platforms.

New Analytic Story - [6]

New Analytics - [19]

Other Updates

  • Updated several detections for which Github issues were reported. Please view this complete list of updates that are made to address false positives, efficiency and improved detection logic

🔴 BREAKING CHANGES :