Added the following new Alert Rules: 

• LP_Certify Tool Execution for AD CS Abuse
• LP_Certipy Tool Execution for AD CS Abuse
• LP_CVE-2024-38112 Exploitation Detected

For more details, see MITRE ATT&CK.

SR-33

Updated query and description of the following Alert Rules:

• LP_Active Directory DLLs Loaded By Office Applications
• LP_Active Directory Module Load in PowerShell
• LP_Activity Related to NTDS Domain Hash Retrieval
• LP_BCDEdit Safe Mode Command Execution
• LP_Credential Access via LaZagne
• LP_DCSync detected
• LP_Executable Files Created and Executed by Office Applications
• LP_Impacket PsExec Execution
• LP_Microsoft Defender AMSI Trigger
• LP_Microsoft Defender Disabling Attempt via PowerShell
• LP_Ngrok RDP Tunnel Detected
• LP_Office Security Settings Changed
• LP_Possible Access to ADMIN Share
• LP_Possible Active Directory Enumeration via AD Module
• LP_Possible GootKit WScript Execution
• LP_Possible Kerberoasting via Rubeus
• LP_PowerShell ADRecon Execution
• LP_Proxy Execution via Explorer
• LP_RClone Utility Execution
• LP_RDP Connection Inititated from Domain Controller
• LP_Remote File Execution via MSIEXEC
• LP_Stealthy VSTO Persistence
• LP_Suspect Svchost Memory Access
• LP_Suspicious CSharp or FSharp Interactive Console Execution
• LP_Suspicious File Deletion Detected
• LP_Suspicious InstallUtil Execution
• LP_Suspicious Microsoft Equation Editor Child Process
• LP_Suspicious PowerShell Parameter Substring Detected
• LP_Suspicious Process Execution via Pester Detected
• LP_Suspicious process spawned by FTP
• LP_Suspicious Root Certificate installation Detected
• LP_Suspicious Scheduled Task Creation
• LP_Suspicious Scheduled Task Creation via Masqueraded XML File
• LP_Suspicious Shells Spawn by SQL Server
• LP_Suspicious Sysmon Driver Unload Detected
• LP_Suspicious VMToolsd Child Process
• LP_Suspicious WMIC Child Process
• LP_Suspicious WMIC XSL Script Execution
• LP_Suspicious WMPRVSE Child Process
• LP_UAC Bypass via SDCLT
• LP_UltraVNC Execution via Command Line
• LP_VBA DLL Loaded by Office
• LP_Weak Encryption Enabled for User
• LP_Windows Crash Dump Disabled
• LP_Windows Error Process Masquerading
• LP_Windows Logon Reminder Usage as Launcher
• LP_Windows User Account Created via Command Line
• LP_WMI DLL Loaded by Office
• LP_WMI Modules Loaded by Suspicious Process

Removed the following generic and redundant Alert Rules:

• LP_HermeticWiper Driver Load
• LP_Microsoft ActiveX Control Code Execution Vulnerability Detected
• LP_Microsoft DotNET Framework Remote Code Execution Detected

Added a new Alert Rule - LP_Behavior Related to Named Pipe Impersonation to detect suspicious events such as creating a named pipe or creating a service with a named pipe. 

For more details, see MITRE ATT&CK.

KB-25063

Updated query and description of the following Alert Rules:

• LP_Active Directory Enumeration via ADFind
• LP_Change of Default File Association Detected
• LP_Clearing of PowerShell Logs Detected
• LP_Command Obfuscation via Character Insertion
• LP_Command Obfuscation via Environment Variable Concatenation Reassembly
• LP_Credential Access via Input Prompt Detected
• LP_Disabling of UAC Detected
• LP_Discovery via PowerSploit Recon Module
• LP_Elevated Command Prompt Activity by Non-Admin User Detected
• LP_Encoded PowerShell Command Detected
• LP_Execution via Control Panel Items
• LP_Execution via HTA using IE JavaScript Engine Detected
• LP_Execution via Windows Scripting Host Component Detected
• LP_File Creation by PowerShell Detected
• LP_High Severity EPP Alert
• LP_Host Generating Multiple High Severity EPP Alert
• LP_Host Generating Multiple Medium Severity EPP Alert
• LP_Local Account Creation on Workstation Detected
• LP_Macro file Creation Detected
• LP_Medium Severity EPP Alert 
• LP_Microsoft Build Engine Loading Credential Libraries
• LP_MsiExec Web Install Detected
• LP_MSTSC Shadowing Detected
• LP_Named Pipe added to Null Session Detected
• LP_Narrators Feedback-Hub Persistence Detected
• LP_NetNTLM Downgrade Attack Detected
• LP_Non Interactive PowerShell Execution
• LP_NoPowerShell Tool Activity Detected
• LP_NotPetya Ransomware Activity Detected
• LP_Password Dumper Activity on LSASS
• LP_Password Dumper Remote Thread in LSASS
• LP_Password Spraying Attack Detected
• LP_Persistence and Execution at Scale via GPO Scheduled Task
• LP_Possible Applocker Bypass Detected
• LP_Possible CLR DLL Loaded Via Office Applications
• LP_Possible Empire Monkey Detected
• LP_PowerShell Execution Policy Modification Detected
• LP_PowerShell Profile Modification
• LP_PowerShell Version Downgrade Detected
• LP_Process Execution from Suspicious Location
• LP_Safe DLL Search Mode Disabled
• LP_Stealthy Scheduled Task Creation via VBA Macro Detected
• LP_Suspicious Taskkill Activity
• LP_Sysmon Configuration Modification Detected
• LP_Sysmon Error Event Detected
• LP_Unsigned Driver Loading Detected

Renamed and updated query of the following Alert Rules:

Removed the following generic and redundant Alert Rules:

• LP_Execution via Squiblydoo Technique Detected
• LP_Firewall Configuration Modification Detected
• LP_Kerberoasting via PowerShell Detected
• LP_Microsoft Office Memory Corruption Vulnerability CVE-2015-1641 Detected
• LP_Microsoft Office Memory Corruption Vulnerability CVE-2017-0199 Detected
• LP_Netsh RDP Port Forwarding Detected
• LP_Suspicious DLL or VBS Files being created in ProgramData
• LP_Suspicious WMIC Process Creation
• LP_Windows CryptoAPI Spoofing Vulnerability Detected
• LP_Windows Login Attempt on Disabled Account
• LP_Windows Suspicious Creation of User Accounts
• LP_WMI Spawning Windows Shell
• LP_WMIExec VBS Script Detected
• LP_Wmiprvse Spawning Process

Added the following new Alert Rules: 

• LP_Outlook Security Settings Change
• LP_Chrome Addition of VPN Extension

For more details, see MITRE ATT&CK.

KB-24605, KB-24012, KB-24567, KB-24603, KB-23839, KB-24555

Updated query and description of the following Alert Rules:

• LP_Active Directory Enumeration via ADFind
• LP_Alternate PowerShell Hosts via Powershell Module
• LP_Clearing of PowerShell Logs Detected
• LP_Copying Sensitive Files with Credential Data
• LP_Direct Autorun Keys Modification Detected
• LP_Execution via Squiblydoo Technique Detected
• LP_File or Folder Permissions Modifications
• LP_Grabbing Sensitive Hives via Reg Utility
• LP_Impacket PsExec Execution
• LP_Macro file Creation Detected
• LP_Malicious PowerShell Commandlets Detected
• LP_Meterpreter or Cobalt Strike Getsystem Service Start Detected
• LP_Microsoft Defender Disabling Attempt via PowerShell
• LP_Password Spraying Attack Detected
• LP_Possible Modification of Boot Configuration
• LP_PowerView PowerShell Commandlets
• LP_PsExec Tool Execution Detected
• LP_RClone Utility Execution
• LP_Rubeus Hack Tool Detected
• LP_Rundll32 Internet Connection Detected
• LP_Shadow Copy Deletion Using OS Utilities Detected
• LP_Suspicious Binary Execution in User Directory
• LP_Suspicious Call by Ordinal Detected
• LP_Suspicious Certutil Command Detected
• LP_Suspicious Child Process Spawned by Microsoft Office Product
• LP_Suspicious Compression Tool Parameters
• LP_Suspicious Execution of LNK File
• LP_Suspicious File Execution via MSHTA
• LP_Suspicious File Extraction via Expand Detected
• LP_Suspicious MSHTA Process Pattern
• LP_Suspicious Msiexec Usage Detected
• LP_Suspicious PowerShell Invocation Based on Parent Process
• LP_Suspicious PowerShell Parameter Substring Detected
• LP_Suspicious Rundll32 Activity Detected
• LP_Suspicious Service Path Modification Detected
• LP_Suspicious Svchost Process Detected
• LP_Suspicious Usage of Advanced IP Scanner
• LP_Suspicious WMI Execution Detected
• LP_Suspicious WMPRVSE Child Process
• LP_System File Execution Location Anomaly Detected
• LP_Transfering Files with Credential Data via Network Shares
• LP_Usage of Web Request Command
• LP_Windows Defender Antivirus Definitions Removal Detected
• LP_Windows User Account Created via Command Line

Renamed and updated query of the following Alert Rules:

Removed the following generic and redundant Alert Rules:

• LP_FromBase64String Command Line Detected
• LP_Microsoft Build Engine started by Office
• LP_Suspicious Commandline Escape Detected
• LP_Suspicious File or Directory Permission Modification
• LP_Suspicious Msiexec Child Process
• LP_Svchost DLL Search Order Hijack Detected

Added CHROME_VPN_EXTENSIONS Knowledge Base (KB) list to search for logs associated with the LP_Chrome Addition of VPN Extension alert rule.