Windows

Windows now also normalizes Application, Process, and Exception data in ASP.NET and MSIInstaller.

Added the following new alerts for Windows events: LP_Possible Pass the Hash Activity Detected LP_Windows Block Inheritance on OU or Domain LP_Windows Delegation of Authority Change on OU or Domain LP_Windows Directory Service State Change LP_Windows GPO Linked or Unlinked to OU or Domain LP_Windows Security Service Terminated LP_Windows User Account Created via Command Line LP_Windows WMI Filter Linked or Unlinked with GPO For more details, go to Windows Alerts .

Updated query and description of the following alerts: Windows Audit Logs Cleared Windows Authentication Policy Change Windows Bulk Print at a Time Windows Data Copied to Removable Device Windows Domain Policy Change Windows Excessive Amount of Files Copied to Removable Device Windows Failed Login Attempt Using Service Account Windows Failed Login Followed by Lockout Event Windows Group Created or Deleted Windows Group Policy Object Change Windows Group Policy Object Creation Windows Group Policy Object Deletion Windows Logon Rights Changes Windows Multiple Account Password changes by User Windows Multiple Failed Attempts against a Single Account Windows Multiple Unique Lockouts Windows OU Creation Windows OU Deletion Windows Successful Brute Force Attack from Same Source Windows Successful Brute Force Attack from Same User Windows User Account Change to End with Dollar Sign Windows User Account Created or Removed Windows User Account was Created with a Dollar Sign Windows User Added or Remove from Group Windows User Added to Administrator Group Windows User Password Never Expires Windows User Removed from Administrator Group Windows User Rights Changes Windows Users Disabled Windows Users Enabled

Removed the following generic and redundant alerts: LP_Windows Account Creation followed by Group Add LP_Windows Audit Policy Changes LP_Windows Authentication on Windows DC LP_Windows Authorization Policy Change LP_Windows Block Inheritance on Domain LP_Windows Block Inheritance on OU LP_Windows Block Inheritance on OU and Domain LP_Windows Critical File Access LP_Windows Critical File Access followed by Cloud App Usage LP_Windows CryptoAPI Spoofing Vulnerability Detected LP_Windows Delegation of Authority Change in OU LP_Windows Delegation of Control Change in Domain LP_Windows Failed Interactive User Logins Detected LP_Windows Failed Login Attempt using an Expired Account LP_Windows Failed Login Attempt using Locked Out Account LP_Windows Failed User Login Attempt LP_Windows File Permission Change LP_Windows GPO Linked Unlinked for the Domain LP_Windows GPO Linked Unlinked to OUs LP_Windows Group Policy Object WMI Filter Changed LP_Windows Member Added to or Removed from Group by Admin LP_Windows Multiple Password Changed by User LP_Windows Ownership of File Taken LP_Windows Permission Change on Critical Folder LP_Windows Permission Change on Home Folder LP_Windows Possible Failed Lateral Movement using Pass the Hash LP_Windows Possible Successful Lateral Movement using Pass the Hash LP_Windows Possible Successful PtH Lateral Movement followed by Audit Log Clear LP_Windows Registry Key Permission Change LP_Windows Registry Value Change LP_Windows Removable Storage Disconnected LP_Windows Revocation of User Privileges detected LP_Windows Security ACL on File Modified LP_Windows Service State Change LP_Windows Suspicious Creation of User Accounts LP_Windows Unusual File Access LP_Windows Unusual User Access to an Object LP_Windows User Account Lockout LP_Windows User Added to Domain Enterprise Admin LP_Windows User Removed from Domain Enterprise Admin

For Windows events, the normalized user field value was the digit "1" instead of the actual user value.

For Windows events, the normalized user field value was the digit "1" instead of the actual user value.