Version 1.25

This update enhances similarity matching (Auto Threat Hunt) controls, introduces new email security detections, refines existing detection rules to reduce false positives, unveils a major Simulations update, and includes some bug fixes.

New ✨

• Add granular similarity matching controls to case details and settings. Material admins can dial in which attributes Material’s similarity matching engine uses to add emails to a case. This includes subject, sender, sender domain, and link.
• Email Security Detections

  • Detection for inbox rules that remove messages
  • NordVPN Impersonation
  • Detection for abuse of known open SMTP relays in extortion campaigns
  • Slack messages impersonating an org’s domain with confusable characters
  • Suspicious signatures containing recipient address

Updated 🔧

• Simulations UI Overhaul

  • Redesigned for better clarity and usability, making it more intuitive and closer to Material’s update look and feel
  • Various bug fixes and performance improvements
• Email Security Detections

  • Lowered severity for inbox filters using sensitive terms
  • Improves rules for Hulu, Facebook, and Airtable impersonation to reduce false positives
  • Facebook Impersonation – tuned to catch billing domain abuse.
  • Adjustments to Webflow links, free subdomain hosts, and fake voicemail notifications to minimize false positives

Fixed 🧹

• Accounts list filter not clearing