This release includes updated MITRE ATT&CK™ technique tags on several rules and added support for Microsoft Graph Security Alert API 1.0 via C2C.
Rules
- [Deleted] OUTLIER-S00012 Spike in AWS New Service Creation or Port Connection from Source Address
- As advised in the advanced notice on July 14th, 2023 - this Outlier rule was deleted due to performance and efficacy findings.
- [Updated] MATCH-S00679 AWS Route 53 Domain Registered
- [Updated] FIRST-S00038 First Seen Wget Usage from User
- [Updated] MATCH-S00830 Office 365 Forwarding Rule Created
- [Updated] LEGACY-S00064 Potentially vulnerable software detected
- [Updated] LEGACY-S00086 SSL Certificate Not Valid Yet
- [Updated] LEGACY-S00087 SSL Heartbleed Attack
- [Updated] LEGACY-S00089 SSL Heartbleed Many Requests
- [Updated] LEGACY-S00090 SSL Heartbleed Odd Length
- [Updated] LEGACY-S00091 SSL Invalid Server Cert
- [Updated] LEGACY-S00096 Shellshock
Log Mappers
- [New] Microsoft Graph Security Alert API C2C
Parsers
- [New] /Parsers/System/Microsoft/Graph Security Alert API