May 6, 2026 – Content Update

We are committed to continuously strengthening security operations for our customers through our innovative DARC Vault monthly releases. Much like Microsoft’s Patch Tuesday, the DARC Vault acts as a consistent and reliable source of enhanced security content, empowering users to stay ahead of evolving threats with fresh detections every month.

Each month, we deliver the latest Out-Of-The-Box (OOTB) content that not only introduces brand-new capabilities but also enhances existing detections. This month, we are excited to announce a significant update focused on Windows.

Below is a summary of the new additions and improvements:

Summary of Fortnightly Improvements

Content Type	Actions	Count
Detections	New	6
	Enhanced	3
Dashboards	New	–
Reports	New	–

New Detections

#	Name	Description
1	WSUS Triggered PsExec Execution from SoftwareDistribution Directory	WSUS Triggered PsExec Execution from SoftwareDistribution Directory under investigation.
2	Service DACL Modification Using SC SDSET Command	Service DACL Modification Using SC SDSET Command under investigation.
3	Sensitive Registry Hive Access from RegBack Directory	Sensitive Registry Hive Access from RegBack Directory under investigation.
4	Sensitive Registry Hive Access from RegBack Directory_ep-file	Sensitive Registry Hive Access from RegBack Directory under investigation.
5	Active Directory NT Security Descriptor Modification on Domain Object	Active Directory NT Security Descriptor Modification on Domain Object under investigation.
6	Hidden Local User Account Created via SAM Registry Modification	Hidden Local User Account Created via SAM Registry Modification under investigation.

Enhanced Detection

#	Name	Description
1	Foxmail Email Client Exploitation via Temp Directory Execution	Foxmail Email Client Exploitation via Temp Directory Execution under investigation.
2	Notepad Markdown File Exploitation Leading to Child Process Execution	Notepad Markdown File Exploitation Leading to Child Process Execution under investigation.
3	VSCode Remote Tunnel Establishment Activity	VSCode Remote Tunnel Establishment Activity under investigation.