Pumpkin spice is back!
Which means it's time for another round of release notes (sadly, not pumpkin spice flavored). September was a big month for detections, with eight new global rules, all shipping disabled by default so you can turn on the ones that fit your environment.
Three are Windows Active Directory reconnaissance detections that came out of a partner red-team exercise and the other five round out some JumpCloud coverage . We also widened AS-REP Roasting so it catches roasting requests the old ticket-options check missed, and stopped New Atypical Service Creation from firing on Microsoft Defender's own update service. On the parsing side, AWS CloudTrail and Oracle Cloud logs sent through HTTP Ingestion are now parsed, along with locally managed Check Point firewalls, UniFi IPS and IDS events, and more Palo Alto Threat log fields.
Detection Updates
| Log Type |
Details |
Windows
|
NEW - Remote SAMR Enumeration of Privileged Groups
This new detection identifies a user remotely querying the membership of privileged local groups, such as Administrators, Remote Desktop Users, and Remote Management Users, across your domain in a short burst. That is exactly how BloodHound and SharpHound map who can log in where, so an attacker can plan their path to domain admin. Catching this reconnaissance step gives you a chance to respond before the attacker moves laterally.
Default state: Disabled |
Windows
|
NEW - Potential Network Enumeration via IPC$ Access
This new detection identifies a user account connecting to the IPC$ share on multiple hosts in quick succession. Attackers and recon tools use IPC$ connections to enumerate shares, users, and sessions across the network once they have a foothold. Routine machine-account traffic is excluded, so what remains is a person-driven sweep worth a closer look.
Default state: Disabled |
Windows
|
NEW - Program Files Directory Masquerading
This new detection identifies executables running from look-alike Program Files folders, for example a folder with an extra space or a slightly different name. Attackers use these trusted-looking paths so their malware blends in with legitimate software. Real Program Files, ProgramData, and user folders are excluded, so a match is unusual by design.
Default state: Disabled |
JumpCloud
|
NEW - JumpCloud: Multiple Administrator Login Failures
This new detection identifies three or more failed JumpCloud administrator logins for the same account within 15 minutes. Admin accounts are the highest-value target in your identity provider, so repeated failures there deserve attention sooner than a regular user's. Catching this early can stop a brute-force attempt before it turns into tenant-wide control.
Default state: Disabled |
JumpCloud
|
NEW - JumpCloud: Multiple Failed Logins Followed by Successful Login
This new detection identifies a successful JumpCloud login that comes after two or more failed attempts for the same user within 30 minutes. A run of failures followed by a success is a classic sign that a guessed or stuffed password finally worked. That success is the moment to check whether the person who logged in is really your user.
Default state: Disabled |
JumpCloud
|
NEW - JumpCloud: Multiple MFA Authentication Failures
This new detection identifies repeated failed MFA attempts for the same JumpCloud user, including push requests that JumpCloud blocked for being too frequent. Repeated MFA failures usually mean someone already has the password and is trying to get past the second factor, often by push bombing the user until they approve. Catching it gives you time to reset the password before a tired user taps Approve.
Default state: Disabled |
JumpCloud
|
NEW - JumpCloud: Service Account Created
This new detection identifies when a service account is created in your JumpCloud tenant. Attackers with admin access create service accounts to keep a quiet, non-interactive way back in that survives user password resets. Service accounts are created rarely, so each one is worth confirming.
Default state: Disabled |
JumpCloud
|
NEW - JumpCloud: Service Account Deleted
This new detection identifies when a service account is deleted from your JumpCloud tenant, for any reason. Deleting a service account can break integrations that depend on it, or cover the tracks of an account an attacker created earlier. Either way, it's a change your team should know about.
Default state: Disabled |
Windows
|
UPDATE - AS-REP Roasting
We expanded this detection to catch AS-REP Roasting no matter which ticket options the attacker's tool requests. It now fires whenever a domain controller successfully issues a ticket to a user account that doesn't require Kerberos pre-authentication, which is the condition attackers need to crack the password offline.
|
Windows
|
UPDATE - New Atypical Service Creation
We refined this detection so the Microsoft Defender Update Service no longer triggers it. A recent Defender platform update started installing this service from a path the detection treated as unusual.
|
Bug Fixes and Improvements
Improvements
- Parsing - AWS CloudTrail via HTTP Ingestion: CloudTrail records sent directly to HTTP Ingestion are now parsed into the AWS CloudTrail log type, so existing AWS detections and reports work without routing logs through another collector.
- Parsing - Oracle Cloud Infrastructure via HTTP Ingestion: OCI Audit and Identity Domain events sent through HTTP Ingestion are now parsed, giving Oracle Cloud customers searchable audit and sign-in data in Blumira.
- Parsing - Check Point Locally Managed Firewalls: Logs from Check Point NGFW firewalls that are managed locally, rather than through a Check Point Management Server, are now parsed.
- Parsing - UniFi IPS and IDS: UniFi and Ubiquiti firewall IPS and IDS events, including those from newer firmware, are now parsed instead of landing in unparsed logs.
- Parsing - Palo Alto Threat Logs: More fields from Palo Alto Threat logs are now parsed into their own columns, so you can search and report on details that were previously buried in a single unparsed field.
August 2026 Release Notes
In case you missed the August updates, you can find and review those notes here.
