Release Notes for v1.9.2

Date: 24 January, 2024

Added:

• New indicators for Windows APIs related to specific activities

• Implemented flagging for LSASS dump using minidump

• Extracted remote templates inside xTable struct in MS Office documents

• Implemented parser for Debian packages

Changed:

• Renamed OPSWAT Filescan Sandbox to MetaDefender Sandbox

• Expanded malware configuration extractors to encompass the latest and most pertinent threats

• Improved detection of dynamic syscalls using the HellsGate bypass technique

• Enhanced Quishing and Phishing email detection

• Improved the capabilities of Batch, CSV, HTA, JavaScript, LNK, PowerShell, VBA, and VBScript emulation and fine-tuned timeout handling

• Extended log messages to provide better traceability across various system components

Fixed:

• Pinned the installed Docker version to 24 due to the breaking changes introduced in Docker 25

• Enhanced Application Security measures, especially for PowerShell emulation

• Fixed incomplete invitation URLs in User Management

• Resolved file scanning issue when file content was sent to the API in JSON body

• Fixed the MISP format when exporting scan reports

• Refactored functional tests for the Webservice API and resolved potential runtime issues

• Fixed several UTF-8 parsing issues in content parsers (related to HTML & OLE files)

• Ensured that all whitelisted submissions get the Benign verdict

• Improved the stability of concurrent OSINT lookup tasks