What's new

ESCU version 5.22.0 was released on February 18, 2026.

Key highlights

ESCU 5.22.0 expands detection coverage into emerging AI infrastructure abuse, destructive wiper activity, and post-exploitation behaviors tied to high-impact enterprise software vulnerabilities. With the introduction of the Suspicious MCP Activities analytic story and a dedicated MCP Technology Add-on (TA), security teams gain direct visibility into how trusted Model Context Protocol (MCP) integrations are being invoked inside their environments. Tactically, this means analysts can detect prompt injection attempts, abnormal database queries, suspicious GitHub automation, and unauthorized filesystem writes before sensitive data is accessed or exfiltrated. Operationally, it allows organizations to govern AI-enabled automation with the same rigor as traditional infrastructure, thereby reducing blind spots created by rapidly deployed AI tooling and helping teams prevent misuse of legitimate automation pathways for lateral movement or privilege escalation.

This release also strengthens defenses against destructive and post-compromise activity. Expanded coverage for DynoWiper and ZOVWiper improves detection of large-scale file overwrite behavior, drive enumeration, and pre-reboot execution patterns associated with Sandworm-linked destructive campaigns—giving customers earlier warning of impact-driven attacks targeting critical systems. Enhanced visibility into SolarWinds Web Help Desk (CVE-2025-26399) post-exploitation activity enables teams to surface suspicious service-based process spawning, persistence mechanisms, and outbound command-and-control behaviors following initial compromise. Together, these updates help organizations contain high-impact incidents faster, reduce dwell time during post-exploitation phases, and strengthen resilience against both emerging AI-enabled tradecraft and destructive nation-state operations.

Following is a summary of the latest updates:

  • Suspicious MCP Activities: Introduced a new analytic story focused on detecting abuse of authorized Model Context Protocol (MCP) server deployments, where legitimate AI tool integrations (filesystem, database, API, and cloud operations) may be weaponized for data exfiltration, privilege escalation, lateral movement, or persistence. This release includes a new MCP Technology Add-on (TA) for parsing MCP server telemetry and adds detections such as MCP Sensitive System File Search, MCP Prompt Injection, MCP Postgres Suspicious Query, MCP GitHub Suspicious Operation, and MCP Filesystem Server Suspicious Extension Write, providing visibility into malicious tool invocation patterns, abnormal data access, and AI-driven attack chains leveraging trusted automation infrastructure.

  • DynoWiper and ZOVWiper (Sandworm Destructive Operations):: Expanded coverage for the destructive malware families DynoWiper and ZOVWiper, attributed to the Russia-aligned threat group Sandworm, by tagging existing endpoint analytics aligned to their file-overwrite, drive enumeration, and system reboot behaviors. These wipers target critical infrastructure and financial sectors, systematically overwriting data across fixed and removable drives while selectively skipping system directories to maximize operational impact. By mapping current detections to known Sandworm tradecraft, this update strengthens visibility into destructive file modification patterns, large-scale overwrite activity, and pre-reboot execution behaviors associated with modern wiper deployments.

  • SolarWinds Web Help Desk RCE (CVE-2025-26399) Post-Exploitation: Tagged existing analytics to enhance visibility into post-exploitation activity following SolarWinds WHD remote code execution, focusing on suspicious process spawning, privilege escalation, lateral movement, persistence mechanisms, and outbound command-and-control behavior originating from compromised Web Help Desk services.

These additions strengthen security teams' ability to detect and respond to emerging threats across critical enterprise platforms.

Other updates

Breaking changes

As previously communicated in the ESCU v5.20.0 release, several detections have been removed. For a complete list of the detections removed in version v5.22.0, refer to the List of Removed Detections.

Users are expected to transition to the recommended replacements where applicable. Additionally, a new set of detections has been deprecated. For details on detections scheduled for removal in ESCU version v5.24.0, see the List of Detections Scheduled for Removal