Releases v2.4.0
Release Notes
New features
#370b43e : Enable callstack for VirtualAlloc events#8e81077 : Enable callstack for OpenProcess and OpenThread events#efdd5e3 : Introduce *.path filter fields#9df026f : New intersects operator#9a14aa9 : New foreach function#bdf9844 : New CreateSymbolicLinkObject event type#1f97cc2 : Incorporate thread pool event telemetry#47564c2 : Expose thread pool filter fields#a83dd8b : Add thread start address symbol and module filter fields#3b8494e : Add additional callstack filter fields#b0dabe0 : Introduce match-all rule engine strategy#19776aa : New isolate rule action
New rules
#122e4b1 : Suspicious object symbolic link creation#d87f913 : LSASS memory dump via MiniDumpWriteDump#328f7be : Potential ClickFix infection chain via Run window#fd099e9 : Executable file dropped by an unsigned service DLL#f317da0 : LSASS handle leak via Seclogon#34c72bb : DLL loaded via LdrpKernel32 overwrite#6659103 : Suspicious access to the hosts file#31fe23d : LSASS access from unsigned executable#20f33d9 : Suspicious Netsh Helper DLL execution#aa2b51c : Potential shellcode execution via ETW logger thread#9ef00e5 : Suspicious execution via WMI from a Microsoft Office process#a72f48f : LSASS process clone creation via reflection#b99ea16 : Potential process creation via shellcode#1cf8151 : Suspicious XSL script execution#e624865 : Suspicious HTML Application script execution#2e056be : Suspicious print processor loaded#070e642 : Suspicious Vault client DLL load#fadd559 : Suspicious Microsoft Office add-in loaded#8d82205 : Potential port monitor or print processor persistence via registry modification#03532e9 : Microsoft Office file execution via WMI#7df0828 : Microsoft Office file execution via script interpreter#bd0f9a0 : Suspicious Windows Defender exclusions registry modification#78c98cf : Windows Defender protection tampering via registry#cca922a : DLL Side-Loading via Microsoft Office dropped file
Enhancements
#5fab88d : Bump golang.org/x/net from 0.21.0 to 0.38.0#efc84b3 : Symbolize thread start address#c73c2c3 : Append/remove module by base address#913b71a : Speed up filter expression String methods#21eb54b : Expand registry persistence keys list macro#eab4790 : Improve callstack decorator#a84c1a1 : Speed up symbol resolution#ad606f0 : substr function with optional argument#4dabdf7 : Limit YARA memory map scans#ae6e263 : Remove system registry provider session#fc38e3e : Revamp and improve rule engine#56b83a0 : Speed up image file characteristics parsing#48c0492 : Better expvar insights for the Stackwalk decorator#4473838 : Improve Unsigned DLL injection via remote thread rule#965c28e : Improve Credential discovery via VaultCmd tool rule#3588421 : New background and banner in MSI installer
Refactoring
#318f593 : Store memory mappings per process#43dad32 : Introduce field arguments in the rule grammar#4c5fd06 : Move callstack into independent package
Bug fixes
#de9d99f : Invalid thread id for MapViewFile/UnmapViewFile events#97e5764 : Private allocation size computation#0026453 : Use iin operator in LSASS memory dump via Windows Error Reporting rule#ea6f95c : Adjust rule YAML indentation in the fibratus rules create CLI#5caa7da : Use process start time from event timestamp#83c8046 : Check if the process executable is not empty to make rules more resistant against false positives#efeeafa : Lookup parent modules in the callstack symbolizer#099900b : Correct the condition in Process spawned from macro-enabled Microsoft Office document rule#33d4a67 : Overwrite Key Control Block (KCB) handle#933bd8a : Ensure event source is closed once#01a80ff : Improve Hidden local account creation rule#dac9381 : Erratic driver identification#1e951d5 : Interpolation for arg-based filter fields#de500a8 : Add process executable exceptions for Potential process injection via tainted memory section rule#a94d08a : Add expire sequence condition for the CreateThread event#3b8bb5c : Check/initialize process state before out-of-order sequence evaluation#3d1006a : Exclusion for OneDrive to tune false positives in Potential process hollowing rule#a367399 : Lookup live modules in symbolizer#0a08b8c : Allow interpolation for filter fields with underscore symbol#e37d1a6 : Reduce Potential privilege escalation via phantom DLL hijacking rule false positives#9f8d98c : Add CompatTelRunner.exe exclusion for Unusual process modified registry run key rule#3355c0e : Rework Script interpreter host or untrusted process persistence rule for better resistance to false positives#c490363 : Rework callstack final user frame heuristics#4dc6121 : Use the correct form of the not operator in rules#495fbb9 : Spurious process executable override#2b39cf4 : Use ps.name field in Macro execution via script interpreter rule#4b411be : General rule false positives reduction
Breaking changes
registry.key, image.name, and file.name now yield the base registry, image, or file name path. Use registry.path, image.path or file.path to obtain the full pathps.ancestor indexed-field now always returns the ancestor process name for the given level. Use the foreach function in conjunction with the ps._ancestors pseudo field to evaluate other process attributesps.modules field has been removed. Use the foreach function in conjunction with the ps._modules pseudo field to evaluate other module attributesps.pe.sections field has been removed. Use the foreach function in conjunction with the pe._sections pseudo field to evaluate other section attributesrarely used callstack indices (ustart, uend, kstart, kend) have been removed
You can’t perform that action at this time.
