We are pleased to announce that our latest Trellix Endpoint Detection and Response with Forensics (EDRF) Cloud threat detection update for September 2026 is now available.
This cumulative report summarizes the detection content released throughout August 2026, adding 59 new detections to your defense stack.
Key threat coverage
-
State-sponsored APTs and espionage: Expanded detection for Chinese UNC6779 zero-day exploitation of Palo Alto GlobalProtect (CVE-2026-0257) and North Korean Diamond Sleet / LONEPAGE fake persona Teams OAuth phishing campaigns.
-
Emerging malware and supply chain attack: Added behavioral coverage for China-nexus JadeProx TriBack Loader DLL sideloading triads, AI-assisted malware targeting labs operating on WebDAV servers, and macOS Miasma network worm activity.
- Zero-day, vulnerability, and telemetry expansion: Deployed proactive detections for the Windows LegacyHive zero-day registry mounting flaw, added detections for process screenshot API abuse, and expanded Active Directory exploitation telemetry.
These updates are fully compatible with all EDR and EDRF client versions. There is no action required.
For more details and a complete list of the changes, see the release details in the Knowledge article Trellix EDRF Cloud Threat Detection Updates – September 2026.