Analytics Content Version: 2024.05.22 - Content Update Release Notes - Cortex XDR - Cortex

Release date: 18 June, 2024

Change type	Changes
Added 2 new Low Analytics BIOCs	Rare SMB session to a remote host Uncommon browser extension loaded
Added a new Informational Analytics BIOC	Unusual DB process spawning a shell
Improved logic of 8 High Analytics BIOCs	Copy a process memory file Editing ld.so.preload for persistence and injection Memory dumping with comsvcs.dll Mimikatz command-line arguments Suspicious usage of File Server Remote VSS Protocol (FSRVP) Uncommon remote scheduled task creation Unicode RTL Override Character Unprivileged process opened a registry hive
Improved logic of 37 Medium Analytics BIOCs	A TCP stream was created directly in a shell A process was executed with a command line obfuscated by Unicode character substitution Autorun.inf created in root C drive Discovery of misconfigured certificate templates using LDAP Encoded information using Windows certificate management tool Executable created to disk by lsass.exe Executable moved to Windows system folder Execution of the Hydra Linux password brute-force tool Fodhelper.exe UAC bypass Indirect command execution using the Program Compatibility Assistant Interactive at.exe privilege escalation method LSASS dump file written to disk Microsoft Office Process Spawning a Suspicious One-Liner Modification of NTLM restrictions in the Registry Office process creates a scheduled task via file access Office process spawned with suspicious command-line arguments Phantom DLL Loading Possible Microsoft process masquerading Possible Persistence via group policy Registry keys Possible RDP session hijacking using tscon.exe Possible code downloading from a remote host by Regsvr32 Possible collection of screen captures with Windows Problem Steps Recorder Possible malicious .NET compilation started by a commonly abused process PowerShell runs suspicious base64-encoded commands PowerShell suspicious flags Procdump executed from an atypical directory Remote WMI process execution Rundll32.exe running with no command-line arguments Rundll32.exe spawns conhost.exe Suspicious .NET process loads an MSBuild DLL Suspicious PowerSploit's recon module (PowerView) net function was executed Suspicious PowerSploit's recon module (PowerView) used to search for exposed hosts Suspicious certutil command line Suspicious disablement of the Windows Firewall Suspicious execution of ODBCConf Uncommon SetWindowsHookEx API invocation of a possible keylogger Unsigned process injecting into a Windows system binary with no command line
Improved logic of 66 Low Analytics BIOCs	Abnormal network communication through TOR using an uncommon port An uncommon service was started An unpopular process accessed the microphone on the host Attempt to execute a command on a remote host using PsExec.exe Cached credentials discovery with cmdkey Change of sudo caching configuration Compressing data using python Conhost.exe spawned a suspicious child process Copy a user's GnuPG directory with rsync Download a script using the python requests module Elevation to SYSTEM via services Execution of dllhost.exe with an empty command line Extracting credentials from Unix files Image file execution options (IFEO) registry key set Installation of a new System-V service Keylogging using system commands Known service display name with uncommon image-path Known service name with an uncommon image-path LOLBIN process executed with a high integrity level Linux system firewall was modified Masquerading as the Linux crond process Microsoft Office adds a value to autostart Registry key Microsoft Office injects code into a process Microsoft Office process spawns a commonly abused process Office process accessed an unusual .LNK file Possible DLL Hijack into a Microsoft process Possible DLL Search Order Hijacking Possible network sniffing attempt via tcpdump or tshark RDP connections enabled remotely via Registry Rare Windows Remote Management (WinRM) HTTP Activity Rare scheduled task created Rare service DLL was added to the registry Reading bash command history file Remote DCOM command execution Remote command execution via wmic.exe Remote service start from an uncommon source Rundll32.exe executes a rare unsigned module SUID/GUID permission discovery Scheduled Task hidden by registry modification Screensaver process executed from Users or temporary folder Scripting engine connected to a rare external host Sensitive browser credential files accessed by a rare non browser process Setuid and Setgid file bit manipulation Stored credentials exported using credwiz.exe Suspicious Certutil AD CS contact Suspicious DotNet log file created Suspicious Print System Remote Protocol usage by a process Suspicious container orchestration job Suspicious process modified RC script file Suspicious process modified an SSH authorized_keys file Suspicious sshpass command execution Suspicious systemd timer activity Svchost.exe loads a rare unsigned module The Linux system firewall was disabled Uncommon PowerShell commands used to create or alter scheduled task parameters Uncommon access to Microsoft Teams credential files Uncommon creation or access operation of sensitive shadow copy Uncommon local scheduled task creation via schtasks.exe Uncommon msiexec execution of an arbitrary file from a remote location Unusual AWS credentials creation Unusual AWS user added to group Unusual compressed file password protection Windows Event Log was cleared using wevtutil.exe Windows event logs were cleared with PowerShell WmiPrvSe.exe Rare Child Command Line Wsmprovhost.exe Rare Child Process
Improved logic of 7 Low Analytics Alerts	Failed Connections Large Upload (Generic) Large Upload (HTTPS) Multiple Rare LOLBIN Process Executions by User Multiple discovery commands Multiple discovery commands on a Windows host by the same process Outlook files accessed by an unsigned process
Improved logic of 55 Informational Analytics BIOCs	A LOLBIN was copied to a different location A compressed file was exfiltrated over SSH A non-browser process accessed a website UI A process connected to a rare external host A service was disabled Adding execution privileges An uncommon file added to startup-related Registry keys An uncommon file was created in the startup folder Browser Extension Installed Browser bookmark files accessed by a rare non-browser process Command execution via wmiexec Creation or modification of the default command executed when opening an application Discovery of host users via WMIC Indicator blocking Injection into rundll32.exe LOLBAS executable injects into another process LOLBIN created a PSScriptPolicyTest PowerShell script file Local account discovery Modification of PAM Msiexec execution of an executable from an uncommon remote location Permission Groups discovery commands Possible DLL Side-Loading Possible Email collection using Outlook RPC Possible binary padding using dd Possible data obfuscation PsExec was executed with a suspicious command line Python HTTP server started Rare AppID usage to a rare destination Rare LOLBIN Process Execution by User Rare Unix process divided files by size Rare connection to external IP address or host by an application using RMI-IIOP or LDAP protocol Rare process execution by user Rare process execution in organization Remote PsExec-like command execution Run downloaded script using pipe Service execution via sc.exe Space after filename Suspicious AMSI decode attempt Suspicious User Login to Domain Controller Suspicious active setup registered Suspicious container runtime connection from within a Kubernetes Pod Suspicious curl user agent Suspicious process executed with a high integrity level Suspicious proxy environment variable setting Suspicious usage of Microsoft's Active Directory PowerShell module remote discovery cmdlet Tampering with Internet Explorer Protected Mode configuration Tampering with the Windows User Account Controls (UAC) configuration Uncommon communication to an instant messaging server Uncommon kernel module load Uncommon net group or localgroup execution Uncommon network tunnel creation Unusual access to the AD Sync credential files Unusual access to the Windows Internal Database on an ADFS server Unusual use of a 'SysInternals' tool VM Detection attempt on Linux
Improved logic of 8 Informational Analytics Alerts	External Login Password Spray Massive file activity abnormal to process Multiple Rare Process Executions in Organization Multiple discovery commands on a Linux host by the same process Multiple discovery-like commands Port Scan Possible data exfiltration over a USB storage device Suspicious container reconnaissance activity in a Kubernetes pod
Changed metadata of a Medium Analytics BIOC	Commonly abused AutoIT script connects to an external domain
Changed metadata of 2 Low Analytics BIOCs	New addition to Windows Defender exclusion list Suspicious data encryption
Changed metadata of an Informational Analytics BIOC	Commonly abused AutoIT script drops an executable file to disk