What's new

ESCU version 5.17.0 delivers powerful new detection content that helps security teams close critical visibility gaps across the web, application, and infrastructure layers. This release introduces analytic stories for Microsoft WSUS CVE-2025-59287 RCE, Oracle E-Business Suite Exploitation (built with Cisco Talos), and HTTP Request Smuggling, giving SOCs actionable detections for deserialization exploits, ERP system attacks, and proxy-layer evasion that often bypass traditional perimeter controls. Coverage for Scattered Lapsus$ Hunters and Hellcat Ransomware extends visibility into identity abuse, remote-access persistence, and AI-enabled ransomware workflows; key areas where human and machine deception tactics increasingly intersect. Together, these 5 new stories and 15 detections strengthen the SOC's ability to detect high-impact intrusions earlier in the kill chain, correlate across data sources, and reduce mean time to detect (MTTD) by transforming stealthy, protocol-level abuse into high-confidence alerts mapped directly to MITRE ATT&CK.

Key highlights

Following is a summary of the latest updates:

  • Microsoft WSUS CVE-2025-59287 Remote Code Execution: Introduced a new analytic story for the exploitation of CVE-2025-59287, a critical WSUS deserialization vulnerability enabling unauthenticated remote code execution. Added a new detection - Windows WSUS Spawning Shell - and tagged related process-based detections to enhance post-exploitation visibility.
  • Oracle E-Business Suite Exploitation (TALOS Collaboration): Released new Snort-based detections developed with Cisco Talos to identify exploitation attempts against Oracle E-Business Suite. These analytics detect anomalous web requests, payload delivery, and lateral movement behaviors targeting enterprise ERP systems based on Snort Alerts
  • HTTP Request Smuggling: Introduced a new analytic story to detect and investigate HTTP request smuggling techniques that exploit discrepancies in how web servers and proxies handle request sequences. Added detections - HTTP Suspicious Tool User Agent, HTTP Request to Reserved Name, HTTP Rapid POST with Mixed Status Codes, HTTP Possible Request Smuggling, and HTTP Duplicated Header - leveraging searches for indicators like CL.TE, TE.TE, and CL.0 to identify abuse of HTTP parsing logic and potential security control bypasses.
  • Scattered Lapsus$ Hunters and Hellcat Ransomware: Tagged a broad set of existing TTPs and added new analytic stories covering the Scattered Lapsus$ Hunters coalition (Scattered Spider, Lapsus$, and Shiny Hunters) and the Hellcat Ransomware RaaS group. These updates enhance visibility into MFA bypass, credential theft, remote access tool abuse, PowerShell infection chains, SSH persistence, and custom ransomware payloads targeting critical infrastructure, telecom, and government sectors.

These additions strengthen security teams' ability to detect and respond to emerging threats across critical enterprise platforms.

New analytics

Other updates

Added new and updated several detections for which Github issues were reported. Please view this complete list of updates that are made to address false positives, efficiency and improved detection logic and names.