February 17, 2023 - Content Release

Note that the following updates do not change detection capabilities and are only updates to descriptions and other metadata.

[Updated] MATCH-S00308 AWS CloudTrail - OpsWorks Describe Permissions Event
[Updated] MATCH-S00210 AWS CloudTrail - SQS List Queues Event
[Updated] MATCH-S00238 AWS CloudTrail - sensitive activity in KMS
[Updated] MATCH-S00594 Alibaba ActionTrail KMS Activity
[Updated] MATCH-S00417 Attrib.exe use to Hide Files and Folders
[Updated] MATCH-S00786 Azure - SQL Database Export
[Updated] MATCH-S00304 External Device Installation Denied
[Updated] FIRST-S00022 First Seen S3 Bucket ACL Enumeration by User
[Updated] MATCH-S00614 GCP Audit KMS Activity
[Updated] MATCH-S00466 MsiExec Web Install
[Updated] MATCH-S00288 NotPetya Ransomware Activity
[Updated] MATCH-S00634 Okta Admin App Access Attempt Failed
[Updated] MATCH-S00633 Okta Admin App Accessed
[Updated] MATCH-S00756 Outlook Homepage Modification
[Updated] MATCH-S00465 PXELoot Utility
[Updated] MATCH-S00200 Potential Pass the Hash Activity
[Updated] MATCH-S00546 Potential Reconnaissance Obfuscation
[Updated] MATCH-S00265 QuarksPwDump Dump File Observed
[Updated] MATCH-S00747 Registry Modification - Active Setup
[Updated] MATCH-S00754 Registry Modification - Microsoft Office Test Function Registry Entry
[Updated] MATCH-S00422 Spaces Before File Extension
[Updated] MATCH-S00196 Successful Overpass the Hash Attempt
[Updated] MATCH-S00293 Suspicious External Device Installation
[Updated] MATCH-S00342 Suspicious use of Dev-Tools-Launcher
[Updated] MATCH-S00279 TAIDOOR RAT DLL Load