July 27, 2026 – Content update

We are committed to continuously strengthening security operations for our customers through our innovative DARC Vault monthly releases. Much like Microsoft’s Patch Tuesday, the DARC Vault acts as a consistent and reliable source of enhanced security content, empowering users to stay ahead of evolving threats with fresh detections every month.

Each month, we deliver the latest Out-Of-The-Box (OOTB) content that not only introduces brand-new capabilities but also enhances existing detections. This month, we are excited to announce a significant update focused on Windows.

Below is a summary of the new additions and improvements:

Summary of Fortnightly Improvements

Content Type	Actions	Count
Detections	New	15
	Enhanced	–
Dashboards	New	–
Reports	New	–

New Detections

#	Name	Description
1	Password Change on Directory Services Restore Mode Account	Investigation of password change on Directory Services Restore Mode account.
2	Local User Account Created by ANONYMOUS LOGON	Local User Account Created by ANONYMOUS LOGON under investigation.
3	High Severity Windows Defender Threat Detection	High Severity Windows Defender Threat Detection under investigation.
4	SAM Registry Hive Handle Request Detection	Detects unauthorized SAM registry access attempts.
5	Download From Suspicious Remote Source	Detects downloads from suspicious remote sources using specific patterns.
6	Sysmon Event Channel Registry Tampering	Sysmon Event Channel Registry Tampering under investigation.
7	Active Directory Privileged Account or Group Enumeration	Active Directory Privileged Account or Group Enumeration under investigation.
8	Active Directory DCSync Replication Request By Non Machine Account	Active Directory DCSync Replication Request By Non Machine Account under investigation.
9	Credential Dumping Tool Service Installation Detection	Detects installation of credential dumping tools on Windows systems.
10	Windows Defender Virus Scanning Feature Disabled	Windows Defender Virus Scanning Feature Disabled under investigation.
11	Suspicious Temporary File Creation by Svchost	Suspicious Temporary File Creation by Svchost under investigation.
12	Kerberos Ticket Kirbi File Creation Detection	Detects creation of Kerberos Ticket Kirbi files in common directories.
13	LSASS Access Via Secondary Logon Service Detection	Detects LSASS access via Secondary Logon Service on Windows.
14	Kali Linux Installation or Execution via WSL	Detects installation or execution of Kali Linux via WSL.
15	LSA Protection Disabled Via Registry Modification	LSA Protection Disabled Via Registry Modification detected. Investigating unauthorized registry changes.