What's new

Here's a summary of the major changes:

• Linux Detection Coverage Expansion: Added broad new Linux behavioral coverage targeting privilege escalation, persistence, execution, defense evasion, reverse shells, container abuse, and suspicious service activity. New analytics identify behaviors including bootloader and system file modification, shared-memory execution, UDEV and XDG persistence, privileged container execution, PostgreSQL and Redis abuse, Ghostscript exploitation, shell history access, and multiple potential privilege-escalation paths, giving defenders stronger visibility into suspicious activity that can blend with legitimate Linux administration.

• Windows Detection Coverage: Expanded Windows detection coverage with new analytics for network reconnaissance, suspicious PowerShell execution, and abnormal process behavior. New detections identify network sniffing tools, PowerShell commands retrieved through DNS TXT records, directory output piped to Findstr, and suspicious child processes of Consent.exe, helping security teams surface discovery, command execution, defense evasion, and other potentially malicious endpoint activity.

• Detection Updates and Fixes: Refined six existing analytics covering administrative SMB shares, high-frequency file copying, network-share discovery, user discovery, and registry-based defense evasion, improving existing detection coverage and fidelity. This release also updates the attacker_tools and malware_user_agents lookups, providing refreshed context to support threat detection and investigation workflows.

Breaking changes