Product Update - Mar. 4th, 2024

New Features & Enhancements

• New Device Posture Check for Cato Client Version: You can require that devices connecting to the network have a minimum Client version installed, by creating a Device Posture check for a specific Client version. This can be added to a Device Posture Profile and then included in your Client Connectivity and security policies.
  • This feature will be gradually enabled over the next few weeks
• Easily View Events for a Network Rule: Now you can use the new View Rule Events action to show the events for a specific Network Rule. When you select this action, the Events page opens and is immediately pre-filtered for all events that match that rule.

Video Feature Overviews

• XDR Detections Report

Security Updates

• IPS Signatures:
  • View more details about the IPS signatures and protections in the Threats Catalog
    • Ransomware 2023lock (New)
    • Ransomware GoodMorning (New)
    • Ransomware Ma1x0 (New)
    • Ransomware Phobos (New)
    • Ransomware SYSDF (New)
    • Ransomware Dxen Ransomware (Enhancement)
    • Ransomware Rocklee Ransomware (Enhancement)
    • Ransomware Stop/Djvu Ransomware (Enhancement)
    • Ransomware Vx-underground Ransomware (Enhancement)
    • Ransomware ZENEX Ransomware (Enhancement)
    • Malware DarkGate CNC Communiaction - Check-In (New)
    • Malware Fewin Stealer Data Exfiltration Attempt (New)
    • Malware GCleaner Downloader - IP Address Retrieval Attempt (New)
    • Malware Lumma Stealer CNC Communication - Exfiltration (New)
    • Malware Reverse Shell Connection - CNC Communication (New)
    • Malware TA402 CnC Communication - User-Agent (New)
    • Malware NodeStealer CNC Communication - Downloaded Archive GET (Enhancement)
    • CVE-2024-22024 (New)
    • CVE-2024-1709 (New)
    • CVE-2023-6623 (New)
    • CVE-2023-51467 (New)
    • CVE-2023-28128 (New)
    • CVE-2023-26255 (New)
    • CVE-2022-36534 (New)
    • CVE-2016-20017 (New)
    • CVE-2023-39677 (New)
    • CVE-2023-38203 (New)
    • CVE-2023-35082 (New)
    • CVE-2023-22527 (New)
    • CVE-2019-3967 (New)
    • CVE-2024-21893 (Enhancement)
    • CVE-2024-21887 (Enhancement)
    • CVE-2023-46805 (Enhancement)
    • CVE-2023-39143 (Enhancement)
    • CVE-2023-45484 (Enhancement)
    • CVE-2023-45480 (Enhancement)
    • Threat Actor r00ts3c-owned-you (New) 
    • Lumma Stealer CNC Communication - Check-In (New)
• Detection & Response
  • These are the updates to the Indications Catalog: 
    • Threat Hunting Indications:
      • Kali Linux Detection (New)
      • Suspicious Binary File Download using WinHTTP (New)
      • Suspicious Tool Download (New)
      • WebShell uploaded (New)
• Suspicious Activity Monitoring:
  • These protections were added to the SAM service:
    • AnyDesk remote desktop connection (New)
    • Process Hacker - download (New)
    • Lateral bash script transfer (New)
    • Phishing heuristic (Enhancement)
• TLS Inspection
  • Added global bypass for these applications, preventing possible TLS inspection errors:
    • Brother Industries
    • Cisco Meraki Cloud
    • Oculus
    • Ring
    • Western Digital
    • Xerox
• Apps Catalog:
  • Added over 100 new SaaS applications (you can view the SaaS apps in the Apps Catalog), and enhanced these applications:
    • Microsoft Copilot (formerly BingAI) 
    • Google Gemini (formerly Bard) 
    • King 
    • WireGuard protocol 
• Application Control (CASB and DLP):  
  • This app is included in DLP scans:
    • Google Gemini - Search
• Client Classification:
  • Greenbone OS