July 7, 2026 – Content Update

We are committed to continuously strengthening security operations for our customers through our innovative DARC Vault monthly releases. Much like Microsoft’s Patch Tuesday, the DARC Vault acts as a consistent and reliable source of enhanced security content, empowering users to stay ahead of evolving threats with fresh detections every month.

Each month, we deliver the latest Out-Of-The-Box (OOTB) content that not only introduces brand-new capabilities but also enhances existing detections. This month, we are excited to announce a significant update focused on Windows.

Below is a summary of the new additions and improvements:

Summary of Fortnightly Improvements

Content Type	Actions	Count
Detections	New	15
	Enhanced	–
Dashboards	New	–
Reports	New	–

New Detections

#	Name	Description
1	Active Directory DCSync Rights Delegation via ntSecurityDescriptor Modification	Active Directory DCSync Rights Delegation via ntSecurityDescriptor Modification under investigation.
2	Detection of NTDS or SAM Database File Copied	Detection of NTDS or SAM Database File Copied under investigation.
3	Microsoft Defender Endpoint Protection Expired	Microsoft Defender Antivirus grace period expired, disabling protection against threats.
4	Potential Credential Access via Windows Utilities	Potential Credential Access via Windows Utilities under investigation.
5	Potential Firewall Defense Impairment via Rule Deletion	Potential Firewall Defense Impairment via Rule Deletion under investigation.
6	Potential NetNTLMv1 Downgrade Attack Detection	Detects potential NetNTLMv1 downgrade attacks by monitoring registry modifications.
7	Suspicious Active Directory Replication Activity	Suspicious Active Directory Replication Activity under investigation.
8	Suspicious Firewall Rule Addition	Suspicious Firewall Rule Addition under investigation.
9	Suspicious Headless Browser Execution from Untrusted Parent Process	Detects headless browser execution from untrusted parent processes.
10	Suspicious Service Installation for Meterpreter and Cobalt Strike Getsystem Detection	Detects suspicious service installations indicating Meterpreter or Cobalt Strike activity.
11	Suspicious Windows Audit Policy Disable Activity	Suspicious Windows Audit Policy Disable Activity under investigation.
12	Suspicious Windows Defender Configuration Changes	Suspicious Windows Defender Configuration Changes detected. Investigating potential disabling of security features.
13	Windows Defender Exploit Guard Tampering	Windows Defender Exploit Guard Tampering under investigation.
14	Windows Defender Security Features Disabled	Windows Defender security features disabled by unauthorized users.
15	Wireless Credential Dumping using Netsh Command	Wireless Credential Dumping using Netsh Command under investigation.