Trellix: Updated Detection Package for Trellix Intelligent Sandbox Now Available

The Intelligent Sandbox updated content package for versions 4.10, 4.12, 4.14, 5.0, and 5.2 are now available.

This detection package adds detection updates to Intelligent Sandbox, and includes the following changes:

New Rules

• Rules to validate the IsDebuggerPresent Function
• Rules to detect embedded pe executables in PowerShell

Updates to Digital Signature Database

• Added 483 new key hashes

For a full list of changes, see the Release Notes.