December 4,2025 – Content Update

We are committed to continuously strengthening security operations for our customers through our innovative DARC Vault monthly releases. Much like Microsoft’s Patch Tuesday, the DARC Vault acts as a consistent and reliable source of enhanced security content, empowering users to stay ahead of evolving threats with fresh detections every month.
Each month, we deliver the latest Out-Of-The-Box (OOTB) content that not only introduces brand-new capabilities but also enhances existing detections. This fortnight, we are excited to announce a significant update focused on VMware ESXi, Windows and Linux.

Below is a summary of the new additions and improvements:

Summary of Fortnightly Improvements

Content Type	Actions	Count
Detections	New	27
	Enhanced	–
Dashboards	New	–
Reports	New	–

New Detections

#	Name	Description
1	Binary File Modification Detected in System Paths	Investigating suspicious binary file changes involving critical commands.
2	User account exposed to Kerberoasting	User account exposed to Kerberoasting under investigation.
3	Potential NTLM Relay Attack against a Computer Account	Potential NTLM Relay Attack against a Computer Account under investigation.
4	Suspicious Named Pipe Coercion Attempt
5	Potential Credential Access via DCSync	Potential Credential Access via DCSync attack under investigation.
6	MsiExec Service Child Process With Network Connection_ep-dns	MsiExec Service Child Process With Network Connection under investigation.
7	MsiExec Service Child Process With Network Connection	MsiExec Service Child Process With Network Connection under investigation.
8	Suspicious Microsoft Antimalware Service Execution	Suspicious Microsoft Antimalware Service Execution detected on Windows platforms.
9	Potential Shellcode Injection into Verclsid Target Process	Potential Shellcode Injection into Verclsid Target Process under investigation.
10	Suspicious Communication App Child Process	Detects suspicious child processes spawned by communication apps.
11	Rare Connection to WebDAV Target	Investigating rare connection to WebDAV target using rundll32.exe and davsetcookie.
12	Kerberos Network Logon Using a Computer Account	Kerberos Network Logon Using a Computer Account under investigation.
13	Potential Computer Account Relay Activity	Investigating potential computer account relay activity on Windows systems.
14	Exfiltration via AWS EventBridge	Exfiltration via AWS EventBridge under investigation.
15	ESXi System Users Enumerated via ESXCLI	ESXi System Users Enumerated via ESXCLI under investigation. Attack involves listing system accounts.
16	ESXi VM IDs Enumerated via ESXCLI or VIM-CMD	ESXi VM IDs enumerated via ESXCLI or VIM-CMD under investigation.
17	ESXi VM Powered Off via VIM-CMD	ESXi VM powered off via VIM-CMD command execution detected. Investigating potential system shutdown/reboot.
18	ESXi Syslog Configuration Changed via ESXCLI	ESXi Syslog Configuration Changed via ESXCLI attack modifies syslog settings.
19	ESXi Firewall Disabled via ESXCLI	ESXi Firewall Disabled via ESXCLI attack under investigation.
20	ESXi VM Autostart Disabled via VIM-CMD	ESXi VM Autostart Disabled via VIM-CMD detected. Investigating command execution disabling autostart.
21	ESXi VIB Acceptance Level Set to Community Supported via ESXCLI	ESXi VIB Acceptance Level Set to Community Supported via ESXCLI command detected.
22	ESXi VM Snapshots Deleted via VIM-CMD	ESXi VM Snapshots Deleted via VIM-CMD under investigation.
23	ESXi Coredump Generation Disabled via ESXCLI	ESXi Coredump Generation Disabled via ESXCLI attack under investigation.
24	ESXi Firewall Default Action Set to Pass	ESXi Firewall Default Action Set to Pass under investigation.
25	ESXi System Storage Enumerated via ESXCL	ESXi System Storage Enumerated via ESXCLne under investigation.
26	ESXi System Information Discovery via VIM-CMD	ESXi System Information Discovery via VIM-CMD under investigation.
27	ESXi Welcome Message Changed via ESXCLI	ESXi Welcome Message Changed via ESXCLI under investigation. Platforms: Linux, Windows, macOS.