May 27, 2026 – Content Update

We are committed to continuously strengthening security operations for our customers through our innovative DARC Vault monthly releases. Much like Microsoft’s Patch Tuesday, the DARC Vault acts as a consistent and reliable source of enhanced security content, empowering users to stay ahead of evolving threats with fresh detections every month.

Each month, we deliver the latest Out-Of-The-Box (OOTB) content that not only introduces brand-new capabilities but also enhances existing detections. This month, we are excited to announce a significant update focused on Windows and Linux.

Below is a summary of the new additions and improvements:

Summary of Fortnightly Improvements

Content Type	Actions	Count
Detections	New	27
	Enhanced	1
Dashboards	New	–
Reports	New	–

New Detections

#	Name	Description
1	Masquerading Space After Filename	Detects processes with trailing spaces in filenames to evade detection.
2	Tampering of Shell Command-Line History	Tampering of Shell Command-Line History involves altering or deleting shell history to evade detection.
3	Potential Traffic Tunneling using QEMU	Potential Traffic Tunneling using QEMU under investigation.
4	Credential Access via TruffleHog Execution	Credential Access via TruffleHog Execution under investigation.
5	PowerShell Keylogging Script Detection	PowerShell Keylogging Script Detection under investigation.
6	Potential Process Injection via PowerShell	Potential Process Injection via PowerShell under investigation.
7	Suspicious HybridConnectionManager Service Installation	Suspicious HybridConnectionManager Service Installation under investigation. Attack targets Linux, Windows, macOS.
8	Invoke-Obfuscation IEX Obfuscation via Service Installation – Security log	Investigating Invoke-Obfuscation IEX via Service Installation
9	Windows Screen Capture Via Powershell	Investigating Windows screen capture via PowerShell script.
10	Potential Invoke-Obfuscation STDIN PowerShell Launcher Execution	Potential Invoke-Obfuscation STDIN+ PowerShell Launcher Execution under investigation.
11	Potential Invoke-Mimikatz PowerShell Script Detection	Potential Invoke-Mimikatz PowerShell Script Detection under investigation.
12	Potential PowerShell Invoke-NinjaCopy Script Execution	Potential PowerShell Invoke-NinjaCopy Script Execution detected via specific script block text patterns.
13	Invoke-Obfuscation IEX Obfuscation via Service Installation	Invoke-Obfuscation IEX Obfuscation via Service Installation under investigation.
14	PowerShell Script with Audio Capture Capabilities	PowerShell script with audio capture capabilities under investigation.
15	Invoke-Obfuscation IEX Obfuscation via PowerShell Script Block	Investigating Invoke-Obfuscation IEX via PowerShell Script Block.
16	Potential Reverse Shell Activity via Terminal	Potential Reverse Shell Activity via Terminal under investigation.
17	Invoke-Obfuscation IEX Obfuscation via Process Execution	Invoke-Obfuscation IEX Obfuscation via Process Execution under investigation.
18	Web Server Access Log Deletion	Investigating deletion of web server access logs to evade detection.
19	Invoke-Obfuscation Detection via Rundll32	Detects obfuscated commands via Rundll32 on Windows systems.
20	Potential Traffic Tunneling using QEMU_ep-process	Potential Traffic Tunneling using QEMU under investigation.
21	Suspicious Web Server Access Log Interaction	Suspicious Web Server Access Log Interaction under investigation.
22	Potential Invoke-Mimikatz PowerShell Process Execution	Potential Invoke-Mimikatz PowerShell Process Execution under investigation.
23	Credential Acquisition via Registry Hive Dumping	Credential Acquisition via Registry Hive Dumping under investigation.
24	Curl or Wget Spawned via Node JS	Detects Curl or Wget commands spawned via Node.js processes.
25	Modification of WDigest Security Provider	Modification of WDigest Security Provider under investigation.
26	Outlook Home Page Registry Modification	Outlook Home Page Registry Modification under investigation. Targets Office Suite, Windows.
27	Credential Acquisition via Registry Hive Dumping_ep-registry	Credential Acquisition via Registry Hive Dumping under investigation. Attack involves modifying registry objects.

Enhanced Detection

#	Name	Description
1	Suspicious Shell History Manipulation	This detection focuses on identifying the deletion or manipulation of the Suspicious Shell History Manipulation (.bash_history). This file logs all commands executed in the Bash shell and is often targeted by malicious actors to cover their tracks. Monitoring such activities is crucial for identifying and mitigating potential threats.