Analytics Content Version: 2024.03.20 - Content Update Release Notes - Cortex XDR - Cortex

Release date: 01 April, 2024

Change type	Changes
Added 2 new Low Analytics BIOCs	Rare service DLL was added to the registry Svchost.exe loads a rare unsigned module
Added 2 new Informational Analytics BIOCs	Browser Extension Installed LOLBIN created a PSScriptPolicyTest PowerShell script file
Added a new Informational Analytics Alert	User and Group Enumeration via SAMR
Improved logic of a Medium Analytics BIOC	Suspicious usage of EC2 token
Improved logic of 4 Low Analytics BIOCs	Azure AD PIM role settings change Azure account deletion by a non-standard account Exchange transport forwarding rule configured Possible DCSync from a non domain controller
Improved logic of 8 Low Analytics Alerts	Abnormal sensitive RPC traffic to multiple hosts Failed Connections Impossible traveler - VPN Large Upload (FTP) Large Upload (Generic) Large Upload (HTTPS) Large Upload (SMTP) Spam Bot Traffic
Improved logic of 9 Informational Analytics BIOCs	A compute-attached identity executed API calls outside the instance's region A container registry was created or deleted A suspicious process queried AD CS objects via LDAP An operation was performed by an identity from a domain that was not seen in the organization Exchange inbox forwarding rule configured Possible DLL Side-Loading PowerShell pfx certificate extraction Suspicious SSO authentication Unusual ADConnect database file access
Improved logic of 6 Informational Analytics Alerts	A user logged on to multiple workstations via Schannel Intense SSO failures Massive upload to a rare storage or mail domain Multiple SSO MFA attempts were rejected by a user SSO Password Spray User moved Exchange sent messages to deleted items
Decreased the severity to Informational for an Analytics BIOC	Azure Temporary Access Pass (TAP) registered to an account
Changed metadata of a Low Analytics BIOC	The Linux system firewall was disabled
Changed metadata of 2 Informational Analytics BIOCs	Suspicious cloud compute instance ssh keys modification attempt Suspicious docker image download from an unusual repository