diff --git a/blog-cse/2026-06-04-content.md b/blog-cse/2026-06-04-content.md new file mode 100644 index 0000000000..2ebe628c09 --- /dev/null +++ b/blog-cse/2026-06-04-content.md @@ -0,0 +1,106 @@ +--- +title: June 4th, 2026 - Content Release +hide_table_of_contents: true +keywords: + - log mappers + - parsers + - schema +image: https://assets-www.sumologic.com/company-logos/_800x418_crop_center-center_82_none/SumoLogic_Preview_600x600.jpg?mtime=1617040082 +--- + +import useBaseUrl from '@docusaurus/useBaseUrl'; + +* This content release includes: + - Updated MITRE ATT&CK tactic and technique tags across 89 rules to align with the MITRE ATT&CK v19 framework update, which reorganized the former Defense Evasion tactic into Stealth and the new Defense Impairment tactic + - Affected rules now reference the correct successor techniques and tactic identifiers, ensuring accurate threat classification in detection workflows + - Additional changes are enumerated below + +## Rules +- [Updated] MATCH-S00307 AWS - Excessive OAuth Application Permissions Scope +- [Updated] MATCH-S00306 AWS - New UserPoolClient Created +- [Updated] MATCH-S00261 AWS CloudTrail - Database Snapshot Created +- [Updated] MATCH-S00113 AWS CloudTrail - Logging Configuration Change Observed +- [Updated] MATCH-S00654 AWS ECS Cluster Deleted +- [Updated] MATCH-S00719 AWS Instance Creation +- [Updated] MATCH-S00720 AWS Instance Deletion +- [Updated] MATCH-S00721 AWS Instance Modification +- [Updated] MATCH-S00598 Alibaba ActionTrail Logging Configuration Change Observed +- [Updated] MATCH-S00516 Antivirus Ransomware Detection +- [Updated] MATCH-S00510 Attempt to Add Certificate to Store +- [Updated] MATCH-S00390 Attempted Credential Dump From Registry Via Reg.Exe +- [Updated] MATCH-S00805 Azure - Bastion Host Created/Modified +- [Updated] MATCH-S00806 Azure - Bastion Host Deleted +- [Updated] MATCH-S00808 Azure - Container Instance Creation/Modification +- [Updated] MATCH-S00809 Azure - Container Start +- [Updated] MATCH-S00786 Azure - SQL Database Export +- [Updated] MATCH-S00303 Azure - Unauthorized OAuth Application +- [Updated] MATCH-S00803 Azure - Virtual Machine Creation/Modification +- [Updated] MATCH-S00804 Azure - Virtual Machine Deleted +- [Updated] MATCH-S00801 Azure - Virtual Machine Started +- [Updated] MATCH-S00802 Azure - Virtual Machine Stopped +- [Updated] MATCH-S00896 Azure Authentication Policy Change +- [Updated] CHAIN-S00022 Azure DevOps - Agent Pool Created and Deleted within a Short Period +- [Updated] FIRST-S00099 Azure DevOps - First Seen User Creating Agent Pool +- [Updated] FIRST-S00092 Azure DevOps - First Seen User Creating Release Pipeline +- [Updated] FIRST-S00097 Azure DevOps - First Seen User Modifying Build Variables +- [Updated] FIRST-S00096 Azure DevOps - First Seen User Modifying Release Pipeline +- [Updated] OUTLIER-S00030 Azure DevOps - Outlier in Pools Deleted Rapidly +- [Updated] MATCH-S00891 Azure OAUTH Application Consent from User +- [Updated] MATCH-S00373 BlueMashroom DLL Load +- [Updated] MATCH-S01155 Claude Compliance API Logging Disabled +- [Updated] MATCH-S01157 Claude Organization IP Restriction Deleted +- [Updated] MATCH-S00758 CrashControl Registry Modification +- [Updated] MATCH-S00544 Disabling Remote User Account Control +- [Updated] MATCH-S00319 Dridex Process Pattern +- [Updated] MATCH-S00392 File or Folder Permissions Modifications +- [Updated] FIRST-S00037 First Seen AWS EKS Admission Controller Created by IP Address +- [Updated] FIRST-S00020 First Seen Azure OAUTH Application Consent from User +- [Updated] FIRST-S00030 First Seen Outbound Connection to External IP Address on Port 445 from IP Address +- [Updated] FIRST-S00034 First Seen Session Token Granted to User from New IP +- [Updated] FIRST-S00087 First Seen User Creating or Modifying EC2 Launch Template +- [Updated] MATCH-S00712 GCP Instance Creation +- [Updated] MATCH-S00713 GCP Instance Deletion +- [Updated] MATCH-S00714 GCP Instance Modification +- [Updated] MATCH-S00958 GitHub - PR Review Requirement Removed +- [Updated] MATCH-S00962 GitHub - Repository Visibility Permissions Changed +- [Updated] MATCH-S00964 GitHub - SSO Recovery Codes Access Activity +- [Updated] MATCH-S00966 GitHub - Two-Factor Authentication Disabled for Organization +- [Updated] MATCH-S00301 Google Workspace - Excessive OAuth Application Permissions Scope +- [Updated] MATCH-S00227 Google Workspace - Unauthorized OAuth Application +- [Updated] MATCH-S00894 HAR file creation observed on host +- [Updated] MATCH-S00850 LastPass - Policy Added +- [Updated] MATCH-S00851 LastPass - Policy Deleted +- [Updated] MATCH-S00852 LastPass - Shared Folder Created +- [Updated] MATCH-S00578 Lsass Registry Key Modified +- [Updated] MATCH-S00534 MacOS - Re-Opened Applications +- [Updated] MATCH-S00729 MacOS Gatekeeper Bypass +- [Updated] MATCH-S00731 MacOS System Integrity Protection Disabled +- [Updated] MATCH-S00397 Mimikatz Loaded Images Detected +- [Updated] MATCH-S00404 Mimikatz via Powershell and EventID 4703 +- [Updated] MATCH-S00655 New Container Uploaded to AWS ECR +- [Updated] MATCH-S00906 Okta - Application Created +- [Updated] FIRST-S00067 Okta - First Seen Client ID/ASN combo in successful OIDC token grant +- [Updated] MATCH-S00683 Overly Permissive Chmod Command +- [Updated] MATCH-S00698 PATH Set to Current Directory +- [Updated] MATCH-S00704 Persistence Registry Key Modification +- [Updated] MATCH-S00200 Potential Pass the Hash Activity +- [Updated] MATCH-S00545 Registry Keys For Creating Shim Databases +- [Updated] MATCH-S00705 Registry Modification - Authentication Package +- [Updated] MATCH-S00730 Registry Modification - Code Signing +- [Updated] MATCH-S00735 Registry Modification - SIP or Trust Provider +- [Updated] MATCH-S00569 Registry Persistence Mechanisms +- [Updated] MATCH-S00328 Rubeus Hack Tool +- [Updated] MATCH-S00498 Rubeus Hack Tool Logon Process Name +- [Updated] LEGACY-S00094 Self-signed Certificates +- [Updated] MATCH-S00834 Sensitive Registry Key (WDigest) Edit +- [Updated] MATCH-S00196 Successful Overpass the Hash Attempt +- [Updated] LEGACY-S00182 Suspicious HTTP User-Agent +- [Updated] MATCH-S00135 Suspicious Registry Key Modification +- [Updated] MATCH-S00886 Suspicious chmod Execution +- [Updated] MATCH-S00567 Ursnif Malware Registry Key +- [Updated] MATCH-S00316 WannaCry Ransomware +- [Updated] MATCH-S00272 Windows - Rogue Domain Controller - dcshadow +- [Updated] MATCH-S00107 Windows - User Adds Self to Security Group +- [Updated] LEGACY-S00169 Windows Account Added To Privileged Security Group +- [Updated] MATCH-S00274 Windows Credential Editor (WCE) Tool Use Detected +- [Updated] MATCH-S00880 macOS - Entitlement Enumeration via Xattr