Prebuilt rule changes per release

The following lists prebuilt rule updates per release. Only rules with significant modifications to their query or scope are listed. For detailed information about a rule’s changes, see the rule’s description page.

AWS EC2 Snapshot Activity

AWS Execution via System Manager

AWS IAM Assume Role Policy Update

AWS IAM Brute Force of Assume Role Policy

AWS Management Console Root Login

AWS Root Login Without MFA

AWS WAF Rule or Rule Group Deletion

Administrator Privileges Assigned to Okta Group

Attempt to Create Okta API Token

Attempt to Deactivate MFA for Okta User Account

Attempt to Deactivate Okta MFA Rule

Attempt to Deactivate Okta Policy

Attempt to Delete Okta Policy

Attempt to Modify Okta MFA Rule

Attempt to Modify Okta Network Zone

Attempt to Modify Okta Policy

Attempt to Reset MFA Factors for Okta User Account

Attempt to Revoke Okta API Token

Attempted Bypass of Okta MFA

Command Prompt Network Connection

Connection to External Network via Telnet

Connection to Internal Network via Telnet

Direct Outbound SMB Connection

Microsoft Build Engine Using an Alternate Name

Modification or Removal of an Okta Application Sign-On Policy

MsBuild Making Network Connections

Net command via SYSTEM account

Netcat Network Activity

Network Connection via Certutil

Network Connection via Compiled HTML File

Network Connection via MsXsl

Network Connection via Registration Utility

Network Connection via Signed Binary

Okta Brute Force or Password Spraying Attack

Possible Okta DoS Attack

Potential Application Shimming via Sdbinst

Potential Evasion via Filter Manager

Potential Modification of Accessibility Binaries

Process Activity via Compiled HTML File

Process Discovery via Tasklist

PsExec Network Connection

Suspicious Activity Reported by Okta User

Threat Detected by Okta ThreatInsight

Trusted Developer Application Usage

Unusual Network Connection via RunDLL32

Unusual Parent-Child Relationship

Unusual Process Network Connection

Whoami Process Activity

Adding Hidden File Attribute via Attrib

Adobe Hijack Persistence

Attempt to Disable IPTables or Firewall

Attempt to Disable Syslog Service

Base16 or Base32 Encoding/Decoding Activity

Base64 Encoding/Decoding Activity

Bypass UAC via Event Viewer

Clearing Windows Event Logs

Command Prompt Network Connection

Connection to External Network via Telnet

Connection to Internal Network via Telnet

DNS Activity to the Internet

Delete Volume USN Journal with Fsutil

Deleting Backup Catalogs with Wbadmin

Direct Outbound SMB Connection

Disable Windows Firewall Rules via Netsh

Encoding or Decoding Files via CertUtil

Enumeration of Kernel Modules

Execution via Regsvcs/Regasm

FTP (File Transfer Protocol) Activity to the Internet

File Deletion via Shred

File Permission Modification in Writable Directory

Hex Encoding/Decoding Activity

Hping Process Activity

IPSEC NAT Traversal Port Activity

IRC (Internet Relay Chat) Protocol Activity to the Internet

Interactive Terminal Spawned via Perl

Interactive Terminal Spawned via Python

Kernel Module Removal

Local Scheduled Task Commands

Local Service Commands

Microsoft Build Engine Loading Windows Credential Libraries

Microsoft Build Engine Started an Unusual Process

Microsoft Build Engine Started by a Script Process

Microsoft Build Engine Started by a System Process

Microsoft Build Engine Started by an Office Application

Microsoft Build Engine Using an Alternate Name

Mknod Process Activity

Modification of Boot Configuration

MsBuild Making Network Connections

Net command via SYSTEM account

Netcat Network Activity

Network Connection via Certutil

Network Connection via Compiled HTML File

Network Connection via MsXsl

Network Connection via Registration Utility

Network Connection via Signed Binary

Network Sniffing via Tcpdump

Nmap Process Activity

Nping Process Activity

PPTP (Point to Point Tunneling Protocol) Activity

Persistence via Kernel Module Modification

Potential DNS Tunneling via Iodine

Potential Disabling of SELinux

Potential Shell via Web Server

PowerShell spawning Cmd

Proxy Port Activity to the Internet

PsExec Network Connection

RDP (Remote Desktop Protocol) from the Internet

RDP (Remote Desktop Protocol) to the Internet

RPC (Remote Procedure Call) from the Internet

RPC (Remote Procedure Call) to the Internet

SMB (Windows File Sharing) Activity to the Internet

SMTP on Port 26/TCP

SMTP to the Internet

SQL Traffic to the Internet

SSH (Secure Shell) from the Internet

SSH (Secure Shell) to the Internet

Setgid Bit Set via chmod

Setuid Bit Set via chmod

Socat Process Activity

Strace Process Activity

Sudoers File Modification

Suspicious MS Office Child Process

Suspicious MS Outlook Child Process

Suspicious PDF Reader Child Process

Svchost spawning Cmd

System Shells via Services

TCP Port 8000 Activity to the Internet

Telnet Port Activity

Tor Activity to the Internet

Unusual Network Connection via RunDLL32

Unusual Parent-Child Relationship

Unusual Process Execution - Temp

Unusual Process Network Connection

User Account Creation

User Discovery via Whoami

VNC (Virtual Network Computing) from the Internet

VNC (Virtual Network Computing) to the Internet

Virtual Machine Fingerprinting

Volume Shadow Copy Deletion via VssAdmin

Volume Shadow Copy Deletion via WMIC

Windows Script Executing PowerShell

Potential Shell via Web Server

Unusual Network Connection via RunDLL32

These prebuilt rules have been removed:

These prebuilt rules have been updated:

Adding Hidden File Attribute via Attrib

Adversary Behavior - Detected - Endpoint Security

Clearing Windows Event Logs

Command Prompt Network Connection

Credential Dumping - Detected - Endpoint Security

Credential Dumping - Prevented - Endpoint Security

Credential Manipulation - Detected - Endpoint Security

Credential Manipulation - Prevented - Endpoint Security

DNS Activity to the Internet

Delete Volume USN Journal with Fsutil

Deleting Backup Catalogs with Wbadmin

Direct Outbound SMB Connection

Disable Windows Firewall Rules via Netsh

Encoding or Decoding Files via CertUtil

Exploit - Detected - Endpoint Security

Exploit - Prevented - Endpoint Security

FTP (File Transfer Protocol) Activity to the Internet

Hping Process Activity

IRC (Internet Relay Chat) Protocol Activity to the Internet

Local Scheduled Task Commands

Local Service Commands

Malware - Detected - Endpoint Security

Malware - Prevented - Endpoint Security

Mknod Process Activity

MsBuild Making Network Connections

Netcat Network Activity

Network Connection via Compiled HTML File

Network Connection via Registration Utility

Network Connection via Signed Binary

Network Sniffing via Tcpdump

Nmap Process Activity

Nping Process Activity

Permission Theft - Detected - Endpoint Security

Permission Theft - Prevented - Endpoint Security

Persistence via Kernel Module Modification

Potential DNS Tunneling via Iodine

Potential Modification of Accessibility Binaries

Process Injection - Detected - Endpoint Security

Process Injection - Prevented - Endpoint Security

Proxy Port Activity to the Internet

PsExec Network Connection

RDP (Remote Desktop Protocol) from the Internet

RDP (Remote Desktop Protocol) to the Internet

RPC (Remote Procedure Call) from the Internet

RPC (Remote Procedure Call) to the Internet

Ransomware - Detected - Endpoint Security

Ransomware - Prevented - Endpoint Security

SMB (Windows File Sharing) Activity to the Internet

SMTP to the Internet

SQL Traffic to the Internet

SSH (Secure Shell) from the Internet

SSH (Secure Shell) to the Internet

Socat Process Activity

Strace Process Activity

Suspicious MS Office Child Process

Suspicious MS Outlook Child Process

System Shells via Services

TCP Port 8000 Activity to the Internet

Tor Activity to the Internet

Trusted Developer Application Usage

Unusual Network Connection via RunDLL32

Unusual Parent-Child Relationship

Unusual Process Execution - Temp

Unusual Process Network Connection

User Account Creation

User Discovery via Whoami

VNC (Virtual Network Computing) from the Internet

VNC (Virtual Network Computing) to the Internet

Volume Shadow Copy Deletion via VssAdmin

Volume Shadow Copy Deletion via WMIC

Web Application Suspicious Activity: No User Agent

Windows Script Executing PowerShell

Adobe Hijack Persistence

DNS Activity to the Internet

FTP (File Transfer Protocol) Activity to the Internet

IPSEC NAT Traversal Port Activity

IRC (Internet Relay Chat) Protocol Activity to the Internet

PPTP (Point to Point Tunneling Protocol) Activity

Potential Shell via Web Server

Proxy Port Activity to the Internet

RDP (Remote Desktop Protocol) from the Internet

RDP (Remote Desktop Protocol) to the Internet

RPC (Remote Procedure Call) from the Internet

RPC (Remote Procedure Call) to the Internet

SMB (Windows File Sharing) Activity to the Internet

SMTP on Port 26/TCP

SMTP to the Internet

SQL Traffic to the Internet

SSH (Secure Shell) from the Internet

SSH (Secure Shell) to the Internet

TCP Port 8000 Activity to the Internet

Telnet Port Activity

Tor Activity to the Internet

VNC (Virtual Network Computing) from the Internet

VNC (Virtual Network Computing) to the Internet