June 2024

JumpCloud User Logs offer visibility into users within an organization's IT environment, capturing a snapshot of all of the users that exist in the JumpCloud system, along with their respective properties such as username, status, etc.

The new integration includes:

• Ingestion of the data to the data lake

Learn more here

MOVEit Transfer is a secure managed file transfer (MFT) software developed by Ipswitch, a subsidiary of Progress Software Corporation. It is designed to provide organizations with a reliable, efficient, and secure way to transfer files, manage workflows, and ensure compliance with data security policies.

MOVEit Transfer logs provide detailed information on file transfer activities, user actions, and system events, capturing data such as source and destination, file size, transfer status, login and logout activities, IP addresses, and authentication methods.

The new integration includes:

• Ingestion of the data to the data lake

• Mapping the data to IOC Search

Learn more here

Trend Micro Deep Security is a comprehensive security solution designed to protect physical, virtual, cloud, and container environments. Trend Micro Deep Security logs provide detailed records of security-related events across protected environments, including physical, virtual, cloud, and container infrastructures.

The new integration includes:

• Ingestion of the data to the data lake

• Mapping the data to IOC Search

Learn more here

We have recently identified the Web application SQL injection attempt detector (web_server_sql_injection) as a low-fidelity detector.

As a result, we have decided to refactor this detector to no longer have group by logic, and instead alert on each attempt individually. This change also allows custom scoring on all relevant fields such as request URI or user agent. we have also revised the conditions on which this detector fires on, in order to reduce false positives and more accurately detect clear-cut SQL injection attempts.

Removed lead attributes:

uri_queries_countreferrers_count, total_duration_sec, stem_target_paths_count, uri_stem_count, user_agents_count, successful_requests_count, grid_array, query_target_paths_count, requests_count.

Added lead attributes:

Server_port, server_username, response_win32_status, response_substatus, response_status, uri_stem_target_path, uri_query_target_path, action, http_method, referrer, request_uri, uri_query, uri_stem, client_request_host, client_ssl_protocol, server_ssl_protocol, user_agent, client_source_port

TL;DR

The Process execution through WMI detector logic was expanded to cover the executions of xsl scripts.

In an effort to expand our coverage in detecting the executing of xsl scripts, we decided to improve the Process execution through WMI detector (`edr_wmic_process_call_create_detector`). The detector will now also detect process execution using WMI /format flag used to execute xsl scripts.

As part of this improvement, we’ve excluded as many legitimate use cases as possible without risking missing suspicious events (i.e. without risking false negatives). We also adjusted the score to align better with our scoring system and lowered the default lead confidence level to Medium instead of High.