Intelligent Sandbox 5.2 Release Notes

This release introduces new features, enhancements or update platform support, and resolves known issues.

Rating

The rating defines the urgency for installing this update.

This update is mandatory for all environments. Failure to apply mandatory updates might result in a security breach. Mandatory updates resolve vulnerabilities that might affect product functionality and compromise security. You must apply these updates to maintain a viable and supported product.

What's new in Intelligent Sandbox 5.2

This release introduces new features and enhances existing features.

New features

As part of rebranding, Intelligent Sandbox 5.2 has updated its URLs and FQDNs. It is recommended to update the new URLs in your firewall to ensure uninterrupted use of Intelligent Sandbox. For more information, see Default ports used in Intelligent Sandbox communication.
When you log in for the first time after deployment or upgrade, Intelligent Sandbox 5.2 prompts you to accept the End User License Agreement (EULA). You will be able to login only after the system-provided admin user has accepted the EULA.
Intelligent Sandbox 5.2 features new CLI commands that allow the syncing of custom behavior rules and monthly detection updates across multiple nodes in a cluster.
- sync yara behaviorrules: This command syncs custom behavior rules from the Primary [Active] or Backup [Active] node to all other nodes in the load balancer cluster.
- sync detectionpkg: This command syncs detection packages from the Primary [Active] or Backup [Active] node to all other nodes in the load balancer cluster.
This version introduces a read-only Command Line Interface account that allows the non-admin users to view and audit the system configurations.
You can now create yara rules on memory dump logs in 5.2.
Intelligent Sandbox collects Windows events and WMI call traces during sample analysis using the following Windows event logs.
- Windows Application Event logs
- Windows System Event logs
- Windows Security Event logs
- WMI traces.
Intelligent Sandbox now supports appliances with Broadcom NIC cards.
Intelligent Sandbox provides increased coverage for the detection of obfuscated JavaScript code, as well as additional information in summary reports in order to understand sample behavior during analysis. This detection is now mapped with the MITRE technique T1059.007 - Command and Scripting Interpreter: JavaScript and T1027 - Obfuscated Files or Information.
With the addition of new behavior APIs, Intelligent Sandbox is now capable of detecting additional malware activities.

Enhancements

Upgraded to OpenSSL-mfe-1.0.2zf-1 and OpenSSL-mfe-libs-1.0.2zf-1 (CVE-2022-1292).
Intelligent Sandbox 5.2 now supports LDAP authentication for all ATD users, including non-admins. For more information, see Configure LDAP.
Intelligent Sandbox has updated its VM Provisioner Tool to provide enhanced VM creation and activation experience and improved resource usage.

Intelligent Sandbox now includes the following techniques and sub techniques as part of an increased coverage of MITRE tactics, techniques, and procedures (TTPs).

ID	MITRE techniques and sub-techniques
T1102	Web Service
T1102.002	Bidirectional Communication
T1614.001	System Location Discovery: System Language Discovery
T1218.014	System Binary Proxy Execution: MMC
T1546.001	Event Triggered Execution: Change Default File Association
T1562.010	Impair Defenses: Downgrade Attack
T1562.002	Disable Windows Event Logging
T1222.001	Windows File and Directory Permissions Modification
T1574.001	Hijack Execution Flow: DLL Side-Loading
T1218.013	Mavinject
T1505.005	Server Software Component: Terminal Services DLL

Resolved issues in 5.2

This release resolves known issues.

Resolution	Reference
ATD-11349	Fixes the parsing issue with XML files in ePO.
ATD-11354	Fixes the UI freeze when clicking on the Update Available option on the dashboard.
ATD-11426	Fixes the UI performance issue with LDAP integration.
ATD-11525	Fixes an issue where users who are not members of the System Administrators group were unable to view the file analysis results of other users.

Resolution	Reference
ATD-11086	Fixes a false positive issue with PDF files containing URLs with Unicode characters.

Known issues

For a list of known issues in this product release, see: Intelligent Sandbox 5.x Known Issues (KB95730).

Supported upgrade paths

These are the possible upgrade paths from your current version of the software to the latest version.

Trellix Intelligent Sandbox initial version	Upgrade Path
4.10.x	4.10.x » 4.14.0 » 5.2
4.12.x	4.12.x » 5.0 » 5.2
4.14.x	4.14.x » 5.2
5.0.x	5.0 » 5.2