March 31, 2026 – Content Update

We are committed to continuously strengthening security operations for our customers through our innovative DARC Vault monthly releases. Much like Microsoft’s Patch Tuesday, the DARC Vault acts as a consistent and reliable source of enhanced security content, empowering users to stay ahead of evolving threats with fresh detections every month.

Each month, we deliver the latest Out-Of-The-Box (OOTB) content that not only introduces brand-new capabilities but also enhances existing detections. This month, we are excited to announce a significant update focused on Windows.

Below is a summary of the new additions and improvements:

Summary of Fortnightly Improvements

Content Type	Actions	Count
Detections	New	13
	Enhanced	1
Dashboards	New	–
Reports	New	–

New Detections

#	Name	Description
1	PowerShell In Memory DotNet Assembly Execution	Detects PowerShell In Memory DotNet Assembly Execution using specific script patterns.
2	Unusual Use of SeIncreaseBasePriorityPrivilege	Unusual Use of SeIncreaseBasePriorityPrivilege under investigation.
3	Suspicious Persistence Creation via Msiexec Using Startup or Registry Run Key ep-file	Suspicious persistence creation via msiexec using startup or registry run keys under investigation.
4	NTLM Authentication Downgrade via LmCompatibilityLevel	Investigating NTLM Authentication Downgrade via LmCompatibilityLevel attack.
5	Suspicious Indirect Command Execution via ForFiles	Suspicious Indirect Command Execution via ForFiles under investigation.
6	Windows Sandbox Misuse with Host File Access	Investigating Windows Sandbox misuse with host file access.
7	Suspicious Script Host Spawned Command Execution	Suspicious Script Host Spawned Command Execution under investigation.
8	Foxmail Email Client Exploitation via Temp Directory Execution	Foxmail Email Client Exploitation via Temp Directory Execution under investigation.
9	Notepad Markdown File Exploitation Leading to Child Process Execution	Notepad Markdown File Exploitation Leading to Child Process Execution under investigation.
10	Suspicious COM RunAs Registry Modification	Suspicious COM RunAs Registry Modification detected. Investigating potential unauthorized registry changes.
11	Suspicious Persistence Creation via Msiexec Using Startup or Registry Run Keys_ep-registry	Suspicious persistence creation via Msiexec using startup or registry run keys under investigation.
12	Downloaded Script Execution via Windows Script Interpreters	Downloaded Script Execution via Windows Script Interpreters under investigation.
13	VSCode Remote Tunnel Establishment Activity	VSCode Remote Tunnel Establishment Activity under investigation.

Enhanced Detection

#	Name	Description
1	System Information Discovery – LINUX	This use case identifies suspicious system information discovery activities by monitoring executed processes captured byauditd. Attackers may execute commands to gather details about the system, network, and users as part of the reconnaissance phase of their attack lifecycle.