Search Results

FeaturesCPU performance enhancement for some applications which burst large numbers of automated & simultaneous directory traversals as part of their application behaviors.FixesMD5 Hashesservice.exe = 3e443b55efdf1c1fd10a2b2931aa1bfd CCRRSecMon.sys (Windows7)...

FeaturesFurther migration from the “Ransomware Rewind” product name to “Cyber Crucible”.Legacy service name "Ransomware Rewind" will migrate to "CyberCrucibleAgent". Process name stays the same.Registry key in HKLM\SOFTWARE will migrate from legacy Ransomware...

FeaturesAdded optional “access type” flags exposed to end users for behavioral access specificity.FixesNone.MD5 Hashesservice.exe = 07a709d672f38ea466de675b8c8f1b76 CCRRSecMon.sys (Windows7) = 4d9195aeda4ae5dafb6f27405b541d9a CCRRSecMon.sys (Windows8) ...

FeaturesWhitelist UpdatesImplemented the ability to create an exception with the parent program path and argumentsImplemented the ability to create an exception to match extortion responses when there are only trusted certs, match only when there are no relate...

FeaturesAdded the ability to automatically free licenses for inactive agents. This feature is a group setting and options are to automatically free licenses for inactive agents in the group after 30/60/90 days, as well as turning this setting offWhitelist Upda...

FeaturesAdded optional SOCKS5 proxy support to assist agent deployment.FixesFixed reinstallations from older agents using the incorrect installation ID.Fixed existing installations from older installers having an unquoted service path.MD5 Hashesservice.exe = ...

FeaturesParent process memory information is available for process reports when modifications were detected.EnhancementsChanged some server communication frequencies to no longer require reboot for adjustment.FixesNone this release.MD5 Hashesservice.exe = 608...

FeaturesBeginning rollout of JWE-based HTTPS communications.Encryption keys are unique to every agent.All payloads encrypted under the HTTPS. Disabled by default during the initial rollout.Ability to optionally revert from JWE-encrypted HTTPS to unencrypted H...

FeaturesMore telemetry for process creations and incidentsUser SIDUser down-level logon nameWhether or not the process is elevated (Run As Administrator)Incidents now report where iterative data access occurredFixesReduced memory usage during periods of server...

FeaturesImplemented the group setting and related endpoints for the setup and management of proxy configurations to assist in agent deploymentUpdated our telemetry data endpoints to be able to view all telemetry data or only data directly related to an extorti...

FeaturesAdded the ability to setup and manage proxy configurations to assist in agent deployment. View more about proxy configurations hereFixed the issue where the horizontal scrollbar at the bottom of our data grids was not visible due to the grid extending ...

FeaturesDMZ ModeOptional configuration to use a signed CA bundle for TLS communication with authentication and telemetry servers. These CA bundles are then protected from tampering or deletion by Cyber Crucible’s proprietary anti-tampering capabilities.OCSP a...

FeaturesKernel-mode Authenticode telemetryFor increased speed and reliability, certificate data for process creations and incidents will be recorded by the driver alone.This update does not remove dependencies on Windows cryptography libraries, but conducts cr...

FeaturesExecutable metadata such as product version, company name, etc. for in-memory processes are reported by the driver via kernel visibility. Normal functionality is to use user-space Windows API calls. This move to parsing in the kernel removing the (ob...

FeaturesAdded support for an optional system tray icon. This feature is disabled by default.FixesAdded workaround for issue requesting kernel Windows API hashing requests. Workaround may be removed at some point in the future if Windows issue is corrected, p...

FeaturesAdded to the Agent licenses page the ability to filter expired licenses from the grid and chart by default. This setting can be updated on the toggle above the agent licenses gridImplemented multi condition filters for a single column on the server sid...

FeaturesImplemented the endpoints for the new Group DMZ Mode settingUpdated the Deal Registration endpoints to be able to register multi-year deals with the ability to pay up front or pay yearly for multi-year dealsAdded the ability to view the root cause anal...

FeaturesKernel-mode DLL telemetryCertificate parsing and trust calculation for all loaded DLLs in the driver.FixesNone.MD5 Hashesservice.exe = f4e017fab1f1117859bcfcd4733cc439 CCRRSecMon.sys (Windows7) = 976f8826ebd5bacb1803fcf6d274a6d0 CCRRSecMon.sys ...