Analytics Content Release Notes Version: 2024.07.17 - Content Update Release Notes - Cortex XDR - Cortex

Release date: 01 August, 2024

Change type	Changes
Added a new Informational Analytics BIOC	Rare DLP rule match by user
Improved logic of a High Analytics BIOC	Copy a process memory file
Improved logic of 3 Medium Analytics BIOCs	Execution of the Hydra Linux password brute-force tool Recurring rare domain access from an unsigned process Windows LOLBIN executable connected to a rare external host
Improved logic of 19 Low Analytics BIOCs	An uncommon service was started Change of sudo caching configuration Compressing data using python Copy a user's GnuPG directory with rsync Installation of a new System-V service Keylogging using system commands Linux system firewall was modified Masquerading as the Linux crond process Possible DLL Hijack into a Microsoft process Possible DLL Search Order Hijacking Rare Windows Remote Management (WinRM) HTTP Activity Setuid and Setgid file bit manipulation Suspicious process modified RC script file Suspicious process modified an SSH authorized_keys file Suspicious sshpass command execution Uncommon AT task-job creation by user Uncommon creation or access operation of sensitive shadow copy Unusual compressed file password protection Unusual process accessed FTP Client credentials
Improved logic of 28 Informational Analytics BIOCs	A compressed file was exfiltrated over SSH Activity in a dormant region of a cloud project Adding execution privileges File transfer from unusual IP using known tools Indicator blocking Kubernetes Pod created with host process ID (PID) namespace Kubernetes Privileged Pod Creation Kubernetes pod creation with host network Kubernetes version disclosure Modification of PAM Permission Groups discovery commands Possible DLL Side-Loading Possible data obfuscation Rare process accessed a Keychain file Run downloaded script using pipe Signed process performed an unpopular injection Suspicious access to shadow file Suspicious process execution from tmp folder Suspicious process execution in a privileged container Uncommon kernel module load Unpopular rsync process execution Unusual DB process spawning a shell Unusual Kubernetes service account file read Unusual exec into a Kubernetes Pod Unusual process accessed a macOS notes DB file Unusual process accessed web browser cookies Unusual process accessed web browser credentials VM Detection attempt on Linux
Improved logic of 3 Informational Analytics Alerts	Kubernetes enumeration activity Multiple discovery commands on a Linux host by the same process Suspicious access to cloud credential files
Changed metadata of a Medium Analytics BIOC	Discovery of misconfigured certificate templates using LDAP
Changed metadata of 2 Low Analytics BIOCs	LDAP search query from an unpopular and unsigned process Suspicious LDAP search query executed
Changed metadata of a Low Analytics Alert	Rare LDAP enumeration
Changed metadata of 6 Informational Analytics BIOCs	A suspicious process queried AD CS objects via LDAP A user queried AD CS objects via LDAP Administrator groups enumerated via LDAP Possible GPO Enumeration Possible LDAP Enumeration Tool Usage Unusual cloud identity impersonation
Changed metadata of 3 Informational Analytics Alerts	A user executed multiple LDAP enumeration queries Possible LDAP enumeration by unsigned process Suspicious reconnaissance using LDAP