v4.25.0

Release notes for ESCU v4.25.0

New Analytics Story

• ConnectWise ScreenConnect Vulnerabilities
• Snake Keylogger
• WordPress Vulnerabilities

Updated Analytics Story

New Analytics

• ConnectWise ScreenConnect Path Traversal
• ConnectWise ScreenConnect Path Traversal Windows SACL
• Windows Non Discord App Access Discord LevelDB
• Windows Time Based Evasion via Choice Exec
• Windows Unsecured Outlook Credentials Access In Registry
• ConnectWise ScreenConnect Authentication Bypass
• WordPress Bricks Builder plugin RCE

Updated Analytics

• Detect Regasm Spawning a Process
• Download Files Using Telegram
• Executables Or Script Creation In Suspicious Path
• High Process Termination Frequency
• Linux Edit Cron Table Parameter
• Non Chrome Process Accessing Chrome Default Dir
• Non Firefox Process Access Firefox Profile Dir
• Processes launching netsh
• Registry Keys Used For Persistence
• Suspicious Driver Loaded Path
• Suspicious Process DNS Query Known Abuse Web Services
• Suspicious Process Executed From Container File
• Windows Credentials from Password Stores Chrome LocalState Access
• Windows Credentials from Password Stores Chrome Login Data Access
• Windows File Transfer Protocol In Non-Common Process Path
• Windows Gather Victim Network Info Through Ip Check Web Services
• Windows Phishing PDF File Executes URL Link
• Windows System Network Connections Discovery Netsh
• Windows User Execution Malicious URL Shortcut File
• WinEvent Scheduled Task Created Within Public Path

Other Updates

• Updated contentctl to output accurate providing technologies in savedsearches.conf