February 26, 2026 – Content Update

We are committed to continuously strengthening security operations for our customers through our innovative DARC Vault monthly releases. Much like Microsoft’s Patch Tuesday, the DARC Vault acts as a consistent and reliable source of enhanced security content, empowering users to stay ahead of evolving threats with fresh detections every month.

Each month, we deliver the latest Out-Of-The-Box (OOTB) content that not only introduces brand-new capabilities but also enhances existing detections. This month, we are excited to announce a significant update focused on Windows.

Below is a summary of the new additions and improvements:

Summary of Fortnightly Improvements

Content Type	Actions	Count
Detections	New	14
	Enhanced	–
Dashboards	New	–
Reports	New	–

New Detections

#	Name	Description
1	Active Directory Discovery via ADExplorer	Active Directory Discovery via ADExplorer is under investigation.
2	NetSupport Manager Execution from Unusual  Paths	NetSupport Manager Execution from Unusual Paths under investigation.
3	Potential Execution via FileFix Phishing Attack	Potential Execution via FileFix Phishing Attack under investigation.
4	Potential RCE via Malicious URL Shortcut and WebDAV	Potential RCE via Malicious URL Shortcut and WebDAV under investigation.
5	Potential REMCOS Remote Access Trojan Activity	Potential REMCOS Remote Access Trojan Activity under investigation.
6	Potential REMCOS Remote Access Trojan Activity_ep-registry	Potential REMCOS Remote Access Trojan Activity detected in registry modifications.
7	Potential System Boot File Tampering via Deletion or Modification	Potential System Boot File Tampering via Deletion or Modification under investigation.
8	Potential Web Shell ASPX File Creation	Investigating potential web shell ASPX file creation in Microsoft Shared Web Server Extensions.
9	Suspicious DNS Communication to High-Risk TLDs by LOLBINs	Suspicious DNS Communication to High-Risk TLDs by LOLBINs under investigation.
10	Suspicious Modification of WINDIR  or SystemRoot Environment Variables	Suspicious modification of WINDIR or SystemRoot environment variables detected.
11	Suspicious Service ImagePath Registry Modification	Suspicious modification of service ImagePath registry key.
12	Suspicious System File Ownership or Permission Modification	Suspicious System File Ownership or Permission Modification investigation.
13	WDAC Policy File creation by an Unusual Process	WDAC Policy File creation by an Unusual Process under investigation.
14	Windows Script Execution from Archive via Compressed Files	Investigating Windows Script Execution from an Archive via Compressed Files.