Analytics Content Version: 2024.09.18 - Content Update Release Notes - Cortex - Cortex XDR

Release date: 8 October, 2024

Change type	Changes
Added a new Medium Analytics BIOC	Parsing Rule Error
Added 5 new Low Analytics BIOCs	A Command Line Interface (CLI) command was executed from a GCP serverless compute service A Command Line Interface (CLI) command was executed from an AWS serverless compute service Kubernetes pod creation from unknown container image registry Possible path traversal via HTTP request Suspicious setspn.exe execution
Added 3 new Informational Analytics BIOCs	Executable or Script file written by web server process Rare MS-Update Server was detected Unique client computer model was detected via MS-Update protocol
Improved logic of 23 High Analytics BIOCs	A Successful VPN connection from TOR A Successful login from TOR A successful SSO sign-in from TOR Bronze-Bit exploit Collection error Copy a process memory file Editing ld.so.preload for persistence and injection Memory dumping with comsvcs.dll Mimikatz command-line arguments Netcat makes or gets connections Possible DCShadow attempt Possible Distributed File System Namespace Management (DFSNM) abuse PowerShell used to remove mailbox export request logs Process execution with a suspicious command line indicative of the Spring4Shell exploit Remote service command execution from an uncommon source Suspicious API call from a Tor exit node Suspicious SaaS API call from a Tor exit node Suspicious dump of ntds.dit using Shadow Copy with ntdsutil/vssadmin Suspicious usage of File Server Remote VSS Protocol (FSRVP) Uncommon remote scheduled task creation Unicode RTL Override Character Unprivileged process opened a registry hive Wbadmin deleted files in quiet mode
Improved logic of 2 High Analytics Alerts	Possible brute force or configuration change attempt on cytool Suspicious objects encryption in an AWS bucket
Improved logic of 86 Medium Analytics BIOCs	A Kubernetes API operation was successfully invoked by an anonymous user A Kubernetes dashboard service account was used outside the cluster A Possible crypto miner was detected on a host A TCP stream was created directly in a shell A contained executable from a mounted share initiated a suspicious outbound network connection A contained executable was executed by an unusual process A machine certificate was issued with a mismatch A mail forwarding rule was configured in Google Workspace A process was executed with a command line obfuscated by Unicode character substitution A suspicious executable with multiple file extensions was created Autorun.inf created in root C drive Azure AD PIM alert disabled Bitsadmin.exe persistence using command-line callback Commonly abused AutoIT script connects to an external domain Correlation rule error Discovery of misconfigured certificate templates using LDAP Encoded information using Windows certificate management tool Error in event forwarding Executable created to disk by lsass.exe Executable moved to Windows system folder Execution of the Hydra Linux password brute-force tool Fodhelper.exe UAC bypass Indirect command execution using the Program Compatibility Assistant Interactive at.exe privilege escalation method Kerberos Traffic from Non-Standard Process Kubernetes vulnerability scanner activity Kubernetes vulnerability scanning tool usage LSASS dump file written to disk MSI accessed a web page running a server-side script Machine account was added to a domain admins group Mailbox Client Access Setting (CAS) changed Manipulation of netsh helper DLLs Registry keys Microsoft Office Process Spawning a Suspicious One-Liner Modification of NTLM restrictions in the Registry Office process creates a scheduled task via file access Office process spawned with suspicious command-line arguments Penetration testing tool activity Phantom DLL Loading Possible Microsoft process masquerading Possible Persistence via group policy Registry keys Possible RDP session hijacking using tscon.exe Possible Search For Password Files Possible code downloading from a remote host by Regsvr32 Possible collection of screen captures with Windows Problem Steps Recorder Possible compromised machine account Possible malicious .NET compilation started by a commonly abused process Possible new DHCP server PowerShell runs suspicious base64-encoded commands PowerShell suspicious flags PowerShell used to export mailbox contents Procdump executed from an atypical directory RDP Connection to localhost Recurring rare domain access from an unsigned process Remote WMI process execution Reverse SSH tunnel to external domain/ip Rundll32.exe running with no command-line arguments Rundll32.exe spawns conhost.exe Script file added to startup-related Registry keys Service ticket request with a spoofed sAMAccountName Suspicious .NET process loads an MSBuild DLL Suspicious Encrypting File System Remote call (EFSRPC) to domain controller Suspicious PowerSploit's recon module (PowerView) net function was executed Suspicious PowerSploit's recon module (PowerView) used to search for exposed hosts Suspicious Process Spawned by wininit.exe Suspicious SearchProtocolHost.exe parent process Suspicious authentication package registered Suspicious authentication with Azure Password Hash Sync user Suspicious certutil command line Suspicious disablement of the Windows Firewall Suspicious disablement of the Windows Firewall using PowerShell commands Suspicious execution of ODBCConf Suspicious heavy allocation of compute resources - possible mining activity Suspicious hidden user created Suspicious print processor registered Suspicious time provider registered Suspicious usage of EC2 token TGT request with a spoofed sAMAccountName - Event log TGT request with a spoofed sAMAccountName - Network The CA policy EditFlags was queried Uncommon Service Create/Config Uncommon SetWindowsHookEx API invocation of a possible keylogger Uncommon jsp file write by a Java process Unsigned process injecting into a Windows system binary with no command line Vulnerable driver loaded Windows Installer exploitation for local privilege escalation Windows LOLBIN executable connected to a rare external host
Improved logic of 10 Medium Analytics Alerts	A contained process attempted to escape using the 'notify on release' feature A new machine attempted Kerberos delegation An internal Cloud resource performed port scan on external networks DNS Tunneling Kerberos User Enumeration NTLM Hash Harvesting New Administrative Behavior Possible Kerberoasting attack Random-Looking Domain Names Sudoedit Brute force attempt
Improved logic of 190 Low Analytics BIOCs	A GCP service account was delegated domain-wide authority in Google Workspace A cloud function was created with an unusual runtime A compiled HTML help file wrote a script file to the disk A computer account was promoted to DC A disabled user attempted to log in to a VPN A domain was added to the trusted domains list A rare FTP user has been detected on an existing FTP server A rare file path was added to the AppInit_DLLs registry value A remote service was created via RPC over SMB A suspicious direct syscall was executed A suspicious process enrolled for a certificate A user attempted to bypass Okta MFA AWS Flow Logs deletion AWS Guard-Duty detector deletion AWS network ACL rule deletion AWS web ACL deletion Abnormal network communication through TOR using an uncommon port An Azure Firewall policy deletion An uncommon executable was remotely written over SMB to an uncommon destination An uncommon service was started An unpopular process accessed the microphone on the host Attempt to execute a command on a remote host using PsExec.exe Azure AD PIM role settings change Azure Event Hub Deletion Azure Network Watcher Deletion Azure account deletion by a non-standard account Azure domain federation settings modification attempt Billing admin role was removed Cached credentials discovery with cmdkey Certutil pfx parsing Change of sudo caching configuration Cloud Trail logging deletion Command running with COMSPEC in the command line argument Compressing data using python Conditional Access policy removed Conhost.exe spawned a suspicious cmd process Contained process execution with a rare GitHub URL Copy a user's GnuPG directory with rsync Delayed Deletion of Files Disable encryption operations Download a script using the python requests module Elevation to SYSTEM via services Exchange DKIM signing configuration disabled Exchange Safe Attachment policy disabled or removed Exchange Safe Link policy disabled or removed Exchange anti-phish policy disabled or removed Exchange audit log disabled Exchange mailbox audit bypass Exchange malware filter policy removed Exchange transport forwarding rule configured Exchange user mailbox forwarding Execution of an uncommon process at an early startup stage by Windows system binary Execution of an uncommon process with a local/domain user SID at an early startup stage by Windows system binary Execution of dllhost.exe with an empty command line Execution of renamed lolbin Extracting credentials from Unix files FTP Connection Using an Anonymous Login or Default Credentials First Azure AD PowerShell operation for a user GCP Logging Sink Deletion Globally uncommon root domain from a signed process Globally uncommon root-domain port combination from a signed process Image file execution options (IFEO) registry key set Installation of a new System-V service Interactive login by a service account Keylogging using system commands Known service display name with uncommon image-path Known service name with an uncommon image-path LDAP search query from an unpopular and unsigned process LOLBIN process executed with a high integrity level Linux system firewall was modified MFA Disabled for Google Workspace MFA was disabled for an Azure identity Masquerading as a default local account Masquerading as the Linux crond process Microsoft Office adds a value to autostart Registry key Microsoft Office injects code into a process Microsoft Office process spawns a commonly abused process MpCmdRun.exe was used to download files into the system Mshta.exe launched with suspicious arguments New FTP Server New addition to Windows Defender exclusion list Non-browser access to a pastebin-like site Office process accessed an unusual .LNK file Okta Reported Attack Suspected Possible DCSync from a non domain controller Possible DLL Hijack into a Microsoft process Possible DLL Search Order Hijacking Possible Kerberoasting without SPNs Possible Kerberos relay attack Possible Pass-the-Hash Possible network service discovery via command-line tool Possible network sniffing attempt via tcpdump or tshark PowerShell Initiates a Network Connection to GitHub RDP connections enabled remotely via Registry Rare RDP session to a remote host Rare SMB session to a remote host Rare SSH Session Rare Unsigned Process Spawned by Office Process Under Suspicious Directory Rare Windows Remote Management (WinRM) HTTP Activity Rare communication over email ports to external email server by unsigned process Rare file transfer over SMB protocol Rare scheduled task created Rare security product signed executable executed in the network Rare service DLL was added to the registry Reading bash command history file Recurring access to rare IP Recurring rare domain access to dynamic DNS domain Remote DCOM command execution Remote command execution via wmic.exe Remote service start from an uncommon source Remote usage of an AWS service token Remote usage of an Azure Managed Identity token Remote usage of an Azure Service Principal token Rundll32.exe executes a rare unsigned module SMB Traffic from Non-Standard Process SPNs cleared from a machine account SSO authentication by a machine account SSO authentication by a service account SUID/GUID permission discovery Scheduled Task hidden by registry modification Screensaver process executed from Users or temporary folder Scripting engine connected to a rare external host SecureBoot was disabled Sensitive browser credential files accessed by a rare non browser process Setuid and Setgid file bit manipulation Stored credentials exported using credwiz.exe Suspicious Certutil AD CS contact Suspicious DotNet log file created Suspicious ICMP packet Suspicious LDAP search query executed Suspicious PowerShell Command Line Suspicious PowerShell Enumeration of Running Processes Suspicious Print System Remote Protocol usage by a process Suspicious Process Spawned by Adobe Reader Suspicious RunOnce Parent Process Suspicious SMB connection from domain controller Suspicious SSH Downgrade Suspicious Udev driver rule execution manipulation Suspicious container orchestration job Suspicious data encryption Suspicious failed HTTP request - potential Spring4Shell exploit Suspicious modification of the AdminSDHolder's ACL Suspicious module load using direct syscall Suspicious process accessed certificate files Suspicious process execution by scheduled task Suspicious process modified RC script file Suspicious runonce.exe parent process Suspicious sAMAccountName change Suspicious sshpass command execution Suspicious systemd timer activity Svchost.exe loads a rare unsigned module System information discovery via psinfo.exe The Linux system firewall was disabled Uncommon ARP cache listing via arp.exe Uncommon AT task-job creation by user Uncommon IP Configuration Listing via ipconfig.exe Uncommon NtWriteVirtualMemoryRemote API invocation with a PE header buffer Uncommon PowerShell commands used to create or alter scheduled task parameters Uncommon Remote Monitoring and Management Tool Uncommon SSH session was established Uncommon Security Support Provider (SSP) registered via a registry key Uncommon access to Microsoft Teams credential files Uncommon creation or access operation of sensitive shadow copy Uncommon local scheduled task creation via schtasks.exe Uncommon msiexec execution of an arbitrary file from a remote location Uncommon remote service start via sc.exe Uncommon routing table listing via route.exe Unsigned and unpopular process performed a DLL injection Unsigned and unpopular process performed an injection Unsigned process creates a scheduled task via file access Unusual AWS credentials creation Unusual AWS user added to group Unusual Azure AD sync module load Unusual Kubernetes API server communication from a pod Unusual Kubernetes dashboard communication from a pod Unusual Lolbins Process Spawned by InstallUtil.exe Unusual Netsh PortProxy rule Unusual compressed file password protection Unusual cross projects activity Unusual process accessed FTP Client credentials Unusual process accessed a crypto wallet's files Unusual process accessed a messaging app's files Unusual process accessed a web browser history file VPN login by a service account Weakly-Encrypted Kerberos Ticket Requested Windows Event Log was cleared using wevtutil.exe Windows event logs were cleared with PowerShell WmiPrvSe.exe Rare Child Command Line Wscript/Cscript loads .NET DLLs Wsmprovhost.exe Rare Child Process
Improved logic of 40 Low Analytics Alerts	A user connected a new USB storage device to multiple hosts A user rejected an SSO request from an unusual country A user sent multiple TGT requests to irregular service A user uploaded malware to SharePoint or OneDrive Abnormal ICMP echo (PING) to multiple hosts Abnormal SMB activity to multiple hosts Abnormal sensitive RPC traffic to multiple hosts Account probing An identity dumped multiple secrets from a project Excessive user account lockouts Failed Connections Failed DNS HTTP with suspicious characteristics Impossible traveler - SSO Impossible traveler - VPN Interactive local account enumeration Kerberos Pre-Auth Failures by Host Large Upload (FTP) Large Upload (Generic) Large Upload (HTTPS) Large Upload (SMTP) Multiple Azure AD admin role removals Multiple Rare LOLBIN Process Executions by User Multiple Suspicious FTP Login Attempts Multiple Weakly-Encrypted Kerberos Tickets Received Multiple discovery commands Multiple discovery commands on a Windows host by the same process Multiple suspicious user accounts were created NTLM Brute Force on a Service Account NTLM Brute Force on an Administrator Account New Shared User Account Outlook files accessed by an unsigned process Possible external RDP Brute-Force Rare LDAP enumeration Short-lived user account Spam Bot Traffic Suspicious ICMP traffic that resembles smurf attack Suspicious identity downloaded multiple objects from a bucket User collected remote shared files in an archive VPN login Brute-Force attempt
Improved logic of 412 Informational Analytics BIOCs	A Google Workspace Role privilege was deleted A Google Workspace identity created, assigned or modified a role A Google Workspace identity performed an unusual admin console activity A Google Workspace identity used the security investigation tool A Google Workspace service was configured as unrestricted A Google Workspace user was added to a group A Google Workspace user was removed from a group A Kubernetes ConfigMap was created or deleted A Kubernetes Cronjob was created A Kubernetes DaemonSet was created A Kubernetes Pod was created with a sidecar container A Kubernetes Pod was deleted A Kubernetes ReplicaSet was created A Kubernetes StatefulSet was created A Kubernetes cluster role binding was created or deleted A Kubernetes cluster was created or deleted A Kubernetes deployment was created A Kubernetes ephemeral container was created A Kubernetes namespace was created or deleted A Kubernetes node service account activity from external IP A Kubernetes role binding was created or deleted A Kubernetes secret was created or deleted A Kubernetes service account executed an unusual API call A Kubernetes service account has enumerated its permissions A Kubernetes service account was created or deleted A Kubernetes service was created or deleted A LOLBIN was copied to a different location A New Server was Added to an Azure Active Directory Hybrid Health ADFS Environment A Service Principal was removed from Azure A Torrent client was detected on a host A WMI subscriber was created A browser extension was installed or loaded in an uncommon way A browser was opened in private mode A cloud identity created or modified a security group A cloud identity executed an API call from an unusual country A cloud identity had escalated its permissions A cloud identity invoked IAM related persistence operations A cloud instance was stopped A cloud snapshot was created or modified A cloud storage configuration was modified A compressed file was exfiltrated over SSH A compute-attached identity executed API calls outside the instance's region A container registry was created or deleted A disabled user attempted to authenticate via SSO A disabled user attempted to log in A non-browser process accessed a website UI A process connected to a rare external host A process modified an SSH authorized_keys file A rare local administrator login A service was disabled A suspicious process queried AD CS objects via LDAP A third-party application was authorized to access the Google Workspace APIs A third-party application's access to the Google Workspace domain's resources was revoked A user accessed an uncommon AppID A user account was modified to password never expires A user added a Windows firewall rule A user certificate was issued with a mismatch A user changed the Windows system time A user connected a USB storage device for the first time A user connected a new USB storage device to a host A user connected from a new country A user connected to a VPN from a new country A user created a pfx file for the first time A user created an abnormal password-protected archive A user enabled a default local account A user logged in at an unusual time via SSO A user logged in at an unusual time via VPN A user logged in from an abnormal country or ASN A user logged in to the AWS console for the first time A user modified an Okta network zone A user modified an Okta policy rule A user queried AD CS objects via LDAP A user was added to a Windows security group AWS Cloud Trail log trail modification AWS CloudWatch log group deletion AWS CloudWatch log stream deletion AWS Config Recorder stopped AWS EC2 instance exported into S3 AWS IAM resource group deletion AWS RDS cluster deletion AWS Role Trusted Entity modification AWS Root account activity AWS SSM send command attempt AWS STS temporary credentials were generated AWS SecurityHub findings were modified AWS config resource deletion AWS network ACL rule creation AWS user creation Abnormal Communication to a Rare Domain Abnormal Recurring Communications to a Rare Domain Abnormal User Login to Domain Controller Abnormal process connection to default Meterpreter port Activity in a dormant region of a cloud project Adding execution privileges Admin privileges were granted to a Google Workspace user Administrator groups enumerated via LDAP An AWS EFS File-share mount was deleted An AWS EFS file-share was deleted An AWS EKS cluster was created or deleted An AWS ElastiCache security group was created An AWS ElastiCache security group was modified or deleted An AWS GuardDuty IP set was created An AWS Lambda Function was created An AWS Lambda function was modified An AWS RDS Global Cluster Deletion An AWS RDS instance was created from a snapshot An AWS RDS master password was changed An AWS Route 53 domain was transferred to another AWS account An AWS S3 bucket configuration was modified An AWS SAML provider was modified An AWS SES Email sending settings were modified An AWS SES identity was deleted An Azure Cloud Shell was Created An Azure DNS Zone was modified An Azure Firewall Rule Collection was modified An Azure Firewall was modified An Azure Key Vault key was modified An Azure Key Vault was modified An Azure Kubernetes Cluster was created or deleted An Azure Kubernetes Role or Cluster-Role was modified An Azure Kubernetes Role-Binding or Cluster-Role-Binding was modified or deleted An Azure Kubernetes Service Account was modified or deleted An Azure Network Security Group was modified An Azure Point-to-Site VPN was modified An Azure Suppression Rule was created An Azure VPN Connection was modified An Azure firewall rule group was modified An Azure virtual network Device was modified An Azure virtual network was modified An Email address was added to AWS SES An IAM group was created An app was added to Google Marketplace An app was added to the Google Workspace trusted OAuth apps list An app was removed from a blocked list in Google Workspace An identity accessed Azure Kubernetes Secrets An identity attached an administrative policy to an IAM user/role An identity created or updated password for an IAM user An identity disabled bucket logging An identity started an AWS SSM session An identity was granted permissions to manage user access to Azure resources An operation was performed by an identity from a domain that was not seen in the organization An uncommon file added to startup-related Registry keys An uncommon file was created in the startup folder An unusual archive file creation by a user Aurora DB cluster stopped Authentication Attempt From a Dormant Account Authentication method added to an Azure account Azure AD PIM elevation request Azure AD account unlock/password reset attempt Azure Automation Account Creation Azure Automation Runbook Creation/Modification Azure Automation Runbook Deletion Azure Automation Webhook creation Azure Blob Container Access Level Modification Azure Event Hub Authorization rule creation/modification Azure Key Vault Secrets were modified Azure Key Vault modification Azure Kubernetes events were deleted Azure Resource Group Deletion Azure Storage Account key generated Azure Temporary Access Pass (TAP) registered to an account Azure account creation by a non-standard account Azure application URI modification Azure application consent Azure application credentials added Azure device code authentication flow used Azure diagnostic configuration deletion Azure service principal assigned app role Azure virtual machine commands execution BitLocker key retrieval Browser Extension Installed Browser bookmark files accessed by a rare non-browser process Cloud Organizational policy was created or modified Cloud Trail Logging has been stopped/suspended Cloud Unusual Instance Metadata Service (IMDS) access Cloud Watch alarm deletion Cloud compute instance user data script modification Cloud compute serial console access Cloud email service activity Cloud identity reached a throttling API rate Cloud impersonation attempt by unusual identity type Cloud unusual access key creation Command execution in a Kubernetes pod Command execution via wmiexec Commonly abused AutoIT script drops an executable file to disk Commonly abused process launched as a system service Creation or modification of the default command executed when opening an application DLP sensitive data exposed to external users DSC (Desired State Configuration) lateral movement using PowerShell Data Sharing between GCP and Google Workspace was disabled Denied API call by a Kubernetes service account Device Registration Policy modification Discovery of host users via WMIC EC2 snapshot attribute has been modified Exchange compliance search created Exchange email-hiding inbox rule Exchange email-hiding transport rule Exchange inbox forwarding rule configured Exchange mailbox folder permission modification Execution of an uncommon process at an early startup stage Execution of an uncommon process with a local/domain user SID at an early startup stage External Sharing was turned on for Google Drive Failed Login For Locked-Out Account Failed Login For a Long Username With Special Characters File transfer from unusual IP using known tools First SSO Resource Access in the Organization First SSO access from ASN for user First SSO access from ASN in organization First VPN access attempt from a country in organization First VPN access from ASN for user First VPN access from ASN in organization First connection from a country in organization GCP Firewall Rule Modification GCP Firewall Rule creation GCP IAM Custom Role Creation GCP IAM Role Deletion GCP IAM Service Account Key Deletion GCP Logging Bucket Deletion GCP Logging Sink Modification GCP Pub/Sub Subscription Deletion GCP Pub/Sub Topic Deletion GCP Service Account Disable GCP Service Account creation GCP Service Account deletion GCP Service Account key creation GCP Storage Bucket Configuration Modification GCP Storage Bucket Permissions Modification GCP Storage Bucket deletion GCP VPC Firewall Rule Deletion GCP Virtual Private Cloud (VPC) Network Deletion GCP Virtual Private Network Route Creation GCP Virtual Private Network Route Deletion GCP set IAM policy activity Globally uncommon IP address by a common process (sha256) Globally uncommon IP address connection from a signed process Globally uncommon high entropy module was loaded Globally uncommon high entropy process was executed Globally uncommon image load from a signed process Globally uncommon injection from a signed process Globally uncommon process execution from a signed process Globally uncommon root-domain port combination by a common process (sha256) Gmail delegation was turned on for the organization Gmail routing settings changed Google Marketplace restrictions were modified Google Workspace organizational unit was modified Google Workspace third-party application's security settings were changed Granting Access to an Account Hidden Attribute was added to a file using attrib.exe IAM User added to an IAM group Identity assigned an Azure AD Administrator Role Indicator blocking Injection into rundll32.exe Interactive login by a machine account Interactive login from a shared user account Iptables configuration command was executed Kubernetes Pod Created With Sensitive Volume Kubernetes Pod Created with host Inter Process Communications (IPC) namespace Kubernetes Pod created with host process ID (PID) namespace Kubernetes Privileged Pod Creation Kubernetes admission controller activity Kubernetes cluster events deletion Kubernetes network policy modification Kubernetes nsenter container escape Kubernetes pod creation with host network Kubernetes secret enumeration activity Kubernetes service account activity outside the cluster Kubernetes version disclosure LDAP traffic from non-standard process LOLBAS executable injects into another process LOLBIN created a PSScriptPolicyTest PowerShell script file Local account discovery Local user account creation Login by a dormant user MFA device was removed/deactivated from an IAM user Microsoft 365 DLP policy disabled or removed Modification of PAM Modification or Deletion of an Azure Application Gateway Detected Msiexec execution of an executable from an uncommon remote location Network sniffing detected in Cloud environment Network traffic to a crypto miner related domain detected New process created via a WMI call Okta API Token Created Okta admin privilege assignment Owner added to Azure application PIM privilege member removal Penetration testing tool activity attempt Penetration testing tool attempt Permission Groups discovery commands Ping to localhost from an uncommon, unsigned parent process Possible DLL Side-Loading Possible Email collection using Outlook RPC Possible GPO Enumeration Possible IPFS traffic was detected Possible LDAP Enumeration Tool Usage Possible SPN enumeration Possible binary padding using dd Possible data obfuscation Possible use of IPFS was detected Possible use of a networking driver for network sniffing Possible webshell file written by a web server process PowerShell pfx certificate extraction PsExec was executed with a suspicious command line Python HTTP server started Rare AppID usage to a rare destination Rare DCOM RPC activity Rare DLP rule match by user Rare LOLBIN Process Execution by User Rare NTLM Access By User To Host Rare NTLM Usage by User Rare SMTP/S Session Rare Scheduled Task RPC activity Rare Unix process divided files by size Rare WinRM Session Rare connection to external IP address or host by an application using RMI-IIOP or LDAP protocol Rare machine account creation Rare process accessed a Keychain file Rare process execution by user Rare process execution in organization Rare process spawned by srvany.exe Rare signature signed executable executed in the network Registration of Uncommon .NET Services and/or Assemblies Remote PsExec-like command execution Remote code execution into Kubernetes Pod Remote usage of AWS Lambda's token Remote usage of VM Service Account token Remote usage of an App engine Service Account token Removal of an Azure Owner from an Application or Service Principal Run downloaded script using pipe S3 configuration deletion SSO with abnormal operating system SSO with abnormal user agent SSO with new operating system SaaS suspicious external domain user activity Scrcons.exe Rare Child Process Security tools detection attempt Sensitive account password reset attempt Service execution via sc.exe SharePoint Site Collection admin group addition Signed process performed an unpopular DLL injection Signed process performed an unpopular injection Space after filename Successful unusual guest user invitation Suspicious AMSI decode attempt Suspicious Azure AD interactive sign-in using PowerShell Suspicious External RDP Login Suspicious SSO access from ASN Suspicious SSO authentication Suspicious access to shadow file Suspicious active setup registered Suspicious cloud compute instance ssh keys modification attempt Suspicious container runtime connection from within a Kubernetes Pod Suspicious curl user agent Suspicious docker image download from an unusual repository Suspicious domain user account creation Suspicious process accessed a site masquerading as Google Suspicious process executed with a high integrity level Suspicious process execution from tmp folder Suspicious process execution in a privileged container Suspicious process loads a known PowerShell module Suspicious proxy environment variable setting Suspicious usage of Microsoft's Active Directory PowerShell module remote discovery cmdlet System profiling WMI query execution System shutdown or reboot Tampering with Internet Explorer Protected Mode configuration Tampering with the Windows User Account Controls (UAC) configuration Uncommon DotNet module load relationship Uncommon GetClipboardData API function invocation of a possible information stealer Uncommon Managed Object Format (MOF) compiler usage Uncommon RDP connection Uncommon browser extension loaded Uncommon communication to an instant messaging server Uncommon kernel module load Uncommon net group or localgroup execution Uncommon net localgroup execution Uncommon network tunnel creation Uncommon user management via net.exe Unpopular rsync process execution Unusual ADConnect database file access Unusual AWS systems manager activity Unusual Conditional Access operation for an identity Unusual DB process spawning a shell Unusual IAM enumeration activity by a non-user Identity Unusual Identity and Access Management (IAM) activity Unusual Kubernetes service account file read Unusual access to the AD Sync credential files Unusual access to the Windows Internal Database on an ADFS server Unusual certificate management activity Unusual cloud identity impersonation Unusual exec into a Kubernetes Pod Unusual key management activity Unusual process accessed a macOS notes DB file Unusual process accessed the PowerShell history file Unusual process accessed web browser cookies Unusual process accessed web browser credentials Unusual resource modification by newly seen IAM user Unusual resource modification/creation Unusual secret management activity Unusual use of a 'SysInternals' tool Unusual weak authentication by user Unverified domain added to Azure AD User accessed SaaS resource via anonymous link User account delegation change User added SID History to an account User attempted to connect from a suspicious country User discovery via WMI query execution VM Detection attempt VM Detection attempt on Linux VPN access with an abnormal operating system VPN login by a dormant user VPN login with a machine account Weakly-Encrypted Kerberos TGT Response WebDAV drive mounted from net.exe over HTTPS
Improved logic of 73 Informational Analytics Alerts	A user accessed an abnormal number of files on a remote shared folder A user accessed an abnormal number of remote shared folders A user accessed multiple time-consuming websites A user accessed multiple unusual resources via SSO A user authenticated with weak NTLM to multiple hosts A user established an SMB connection to multiple hosts A user executed multiple LDAP enumeration queries A user logged on to multiple workstations via Schannel A user performed suspiciously massive file activity A user printed an unusual number of files A user received multiple weakly encrypted service tickets A user requested multiple service tickets A user took numerous screenshots Abnormal Allocation of compute resources in multiple regions Allocation of multiple cloud compute resources An identity performed a suspicious download of multiple cloud storage objects Brute-force attempt on a local account Cloud infrastructure enumeration activity Cloud user performed multiple actions that were denied Deletion of multiple cloud resources Download pattern that resembles Peer to Peer traffic Exchange mailbox delegation permissions added External Login Password Spray External SaaS file-sharing activity IAM Enumeration sequence Impossible travel by a cloud identity Increase in Job-Related Site Visits Intense SSO failures Internal Login Password Spray Kerberos Pre-Auth Failures by User and Host Kubernetes enumeration activity Massive file activity abnormal to process Massive file compression by user Massive file downloads from SaaS service Massive upload to SaaS service Massive upload to a rare storage or mail domain Multi region enumeration activity Multiple Rare Process Executions in Organization Multiple SSO MFA attempts were rejected by a user Multiple TGT requests for users without Kerberos pre-authentication Multiple cloud snapshots export Multiple discovery commands on a Linux host by the same process Multiple discovery-like commands Multiple failed logins from a single IP Multiple user accounts were deleted Multiple users authenticated with weak NTLM to a host NTLM Brute Force NTLM Password Spray NTLM Relay Okta Reported Threat Detected Port Scan Possible Brute-Force attempt Possible LDAP enumeration by unsigned process Possible TGT reuse from different hosts (pass the ticket) Possible brute force on sudo user Possible data exfiltration over a USB storage device Possible internal data exfiltration over a USB storage device Rare access to known advertising domains Remote account enumeration SSH authentication brute force attempts SSO Brute Force SSO Password Spray Sensitive Exchange mail sent to external users Short-lived Azure AD user account Storage enumeration activity Suspicious DNS traffic Suspicious access to cloud credential files Suspicious container reconnaissance activity in a Kubernetes pod Suspicious reconnaissance using LDAP Upload pattern that resembles Peer to Peer traffic User added to a group and removed User and Group Enumeration via SAMR User moved Exchange sent messages to deleted items
Removed an old Informational BIOC	Suspicious setspn.exe execution