Analytics Content Version: 2025.01.15 - Content Update Release Notes - Cortex XDR - Cortex

Release date: 29 January, 2025

Change type	Changes
Added a new Medium Analytics Alert	Suspicious Azure enumeration activity
Added a new Low Analytics BIOC	Discovery of accounts with pre-authentication disabled via LDAP
Added 2 new Informational Analytics BIOCs	AppleScript executed a shell script Suspicious NTLM authentication with machine account
Added 3 new Informational Analytics Alerts	Microsoft OneNote enumeration activity Okta account reset password attempt Uncommon WPAD queries
Improved logic of 2 High Analytics BIOCs	Suspicious API call from a Tor exit node Suspicious SaaS API call from a Tor exit node
Improved logic of a High Analytics Alert	Suspicious objects encryption in an AWS bucket
Improved logic of 10 Medium Analytics BIOCs	A Kubernetes API operation was successfully invoked by an anonymous user A Kubernetes dashboard service account was used outside the cluster A mail forwarding rule was configured in Google Workspace Azure AD PIM alert disabled Cloud snapshot of a database or storage instance was publicly shared Discovery of misconfigured certificate templates using LDAP Kubernetes vulnerability scanning tool usage Penetration testing tool activity Suspicious heavy allocation of compute resources - possible mining activity Suspicious usage of EC2 token
Improved logic of 41 Low Analytics BIOCs	A Command Line Interface (CLI) command was executed from a GCP serverless compute service A Command Line Interface (CLI) command was executed from an AWS serverless compute service A GCP service account was delegated domain-wide authority in Google Workspace A cloud function was created with an unusual runtime A domain was added to the trusted domains list A user attempted to bypass Okta MFA AWS Flow Logs deletion AWS Guard-Duty detector deletion AWS network ACL rule deletion AWS web ACL deletion An Azure Firewall policy deletion Azure AD PIM role settings change Azure Event Hub Deletion Azure Network Watcher Deletion Azure account deletion by a non-standard account Azure domain federation settings modification attempt Billing admin role was removed Cloud Trail logging deletion Conditional Access policy removed Disable encryption operations Exchange DKIM signing configuration disabled Exchange Safe Attachment policy disabled or removed Exchange Safe Link policy disabled or removed Exchange anti-phish policy disabled or removed Exchange audit log disabled Exchange mailbox audit bypass Exchange malware filter policy removed Exchange transport forwarding rule configured Exchange user mailbox forwarding First Azure AD PowerShell operation for a user GCP Logging Sink Deletion Kubernetes pod creation from unknown container image registry MFA Disabled for Google Workspace MFA was disabled for an Azure identity Okta Reported Attack Suspected Remote usage of an AWS service token Remote usage of an Azure Managed Identity token Remote usage of an Azure Service Principal token Uncommon SSH session was established Uncommon remote monitoring and management tool Unusual cross projects activity
Improved logic of 4 Low Analytics Alerts	A user uploaded malware to SharePoint or OneDrive An identity dumped multiple secrets from a project Multiple Azure AD admin role removals Suspicious identity downloaded multiple objects from a bucket
Improved logic of 256 Informational Analytics BIOCs	A Google Workspace Role privilege was deleted A Google Workspace identity created, assigned or modified a role A Google Workspace identity performed an unusual admin console activity A Google Workspace identity used the security investigation tool A Google Workspace service was configured as unrestricted A Google Workspace user was added to a group A Google Workspace user was removed from a group A Kubernetes ConfigMap was created or deleted A Kubernetes Cronjob was created A Kubernetes DaemonSet was created A Kubernetes Pod was created with a sidecar container A Kubernetes Pod was deleted A Kubernetes ReplicaSet was created A Kubernetes StatefulSet was created A Kubernetes cluster role binding was created or deleted A Kubernetes cluster was created or deleted A Kubernetes deployment was created A Kubernetes ephemeral container was created A Kubernetes namespace was created or deleted A Kubernetes node service account activity from external IP A Kubernetes role binding was created or deleted A Kubernetes secret was created or deleted A Kubernetes service account executed an unusual API call A Kubernetes service account has enumerated its permissions A Kubernetes service account was created or deleted A Kubernetes service was created or deleted A New Server was Added to an Azure Active Directory Hybrid Health ADFS Environment A Service Principal was created in Azure A Service Principal was removed from Azure A cloud identity created or modified a security group A cloud identity executed an API call from an unusual country A cloud identity had escalated its permissions A cloud identity invoked IAM related persistence operations A cloud instance was stopped A cloud snapshot was created or modified A cloud storage configuration was modified A compute-attached identity executed API calls outside the instance's region A container registry was created or deleted A process connected to a rare external host A third-party application was authorized to access the Google Workspace APIs A third-party application's access to the Google Workspace domain's resources was revoked A user accessed Okta's admin application A user logged in to the AWS console for the first time A user modified an Okta network zone A user modified an Okta policy rule AWS Cloud Trail log trail modification AWS CloudWatch log group deletion AWS CloudWatch log stream deletion AWS Config Recorder stopped AWS EC2 instance exported into S3 AWS IAM resource group deletion AWS RDS cluster deletion AWS Role Trusted Entity modification AWS Root account activity AWS SSM send command attempt AWS STS temporary credentials were generated AWS SecurityHub findings were modified AWS config resource deletion AWS network ACL rule creation AWS user creation Abnormal Communication to a Rare Domain Abnormal Communication to a Rare IP Abnormal Recurring Communications to a Rare Domain Activity in a dormant region of a cloud project Admin privileges were granted to a Google Workspace user An AWS EFS File-share mount was deleted An AWS EFS file-share was deleted An AWS EKS cluster was created or deleted An AWS ElastiCache security group was created An AWS ElastiCache security group was modified or deleted An AWS GuardDuty IP set was created An AWS Lambda Function was created An AWS Lambda function was modified An AWS RDS Global Cluster Deletion An AWS RDS instance was created from a snapshot An AWS Route 53 domain was transferred to another AWS account An AWS S3 bucket configuration was modified An AWS SAML provider was modified An AWS SES Email sending settings were modified An AWS SES identity was deleted An AWS database service master user password was changed An Azure Cloud Shell was Created An Azure DNS Zone was modified An Azure Firewall Rule Collection was modified An Azure Firewall was modified An Azure Key Vault key was modified An Azure Key Vault was modified An Azure Kubernetes Cluster was created or deleted An Azure Kubernetes Role or Cluster-Role was modified An Azure Kubernetes Role-Binding or Cluster-Role-Binding was modified or deleted An Azure Kubernetes Service Account was modified or deleted An Azure Network Security Group was modified An Azure Point-to-Site VPN was modified An Azure Suppression Rule was created An Azure VPN Connection was modified An Azure application reached a throttling API rate An Azure firewall rule group was modified An Azure virtual network Device was modified An Azure virtual network was modified An Email address was added to AWS SES An IAM group was created An app was added to Google Marketplace An app was added to the Google Workspace trusted OAuth apps list An app was removed from a blocked list in Google Workspace An identity accessed Azure Kubernetes Secrets An identity attached an administrative policy to an IAM user/role An identity created or updated password for an IAM user An identity disabled bucket logging An identity started an AWS SSM session An identity was granted permissions to manage user access to Azure resources An operation was performed by an identity from a domain that was not seen in the organization Attempted Azure application access from unknown tenant Aurora DB cluster stopped Authentication method added to an Azure account Authentication method was added to Azure account Azure AD PIM elevation request Azure AD account unlock/password reset attempt Azure Automation Account Creation Azure Automation Runbook Creation/Modification Azure Automation Runbook Deletion Azure Automation Webhook creation Azure Blob Container Access Level Modification Azure Event Hub Authorization rule creation/modification Azure Key Vault Secrets were modified Azure Key Vault modification Azure Kubernetes events were deleted Azure Resource Group Deletion Azure Service principal/Application creation Azure Storage Account key generated Azure Temporary Access Pass (TAP) registered to an account Azure account creation by a non-standard account Azure application URI modification Azure application consent Azure application credentials added Azure application removed Azure conditional access policy creation or modification Azure device code authentication flow used Azure diagnostic configuration deletion Azure group creation/deletion Azure mailbox rule creation Azure permission delegation granted Azure service principal assigned app role Azure user creation/deletion Azure user password reset Azure virtual machine commands execution BitLocker key retrieval Cloud Organizational policy was created or modified Cloud Trail Logging has been stopped/suspended Cloud Watch alarm deletion Cloud compute instance user data script modification Cloud compute serial console access Cloud email service activity Cloud identity reached a throttling API rate Cloud impersonation attempt by unusual identity type Cloud storage automatic backup disabled Cloud storage delete protection disabled Cloud unusual access key creation Credentials were added to Azure application DLP sensitive data exposed to external users Data Sharing between GCP and Google Workspace was disabled Data encryption was disabled Denied API call by a Kubernetes service account Device Registration Policy modification EC2 snapshot attribute has been modified Exchange compliance search created Exchange email-hiding inbox rule Exchange email-hiding transport rule Exchange inbox forwarding rule configured Exchange mailbox folder permission modification External Sharing was turned on for Google Drive External user invitation to Azure tenant GCP Firewall Rule Modification GCP Firewall Rule creation GCP IAM Custom Role Creation GCP IAM Role Deletion GCP IAM Service Account Key Deletion GCP Logging Bucket Deletion GCP Logging Sink Modification GCP Pub/Sub Subscription Deletion GCP Pub/Sub Topic Deletion GCP Service Account Disable GCP Service Account creation GCP Service Account deletion GCP Service Account key creation GCP Storage Bucket Configuration Modification GCP Storage Bucket Permissions Modification GCP Storage Bucket deletion GCP VPC Firewall Rule Deletion GCP Virtual Private Cloud (VPC) Network Deletion GCP Virtual Private Network Route Creation GCP Virtual Private Network Route Deletion GCP set IAM policy activity Gmail delegation was turned on for the organization Gmail routing settings changed Google Marketplace restrictions were modified Google Workspace organizational unit was modified Google Workspace third-party application's security settings were changed Granting Access to an Account IAM User added to an IAM group Identity assigned an Azure AD Administrator Role Kubernetes Pod Created With Sensitive Volume Kubernetes Pod Created with host Inter Process Communications (IPC) namespace Kubernetes Pod created with host process ID (PID) namespace Kubernetes Privileged Pod Creation Kubernetes admission controller activity Kubernetes cluster events deletion Kubernetes network policy modification Kubernetes pod creation with host network Kubernetes service account activity outside the cluster MFA device was removed/deactivated from an IAM user Member added to a Windows local security group Microsoft 365 DLP policy disabled or removed Modification or Deletion of an Azure Application Gateway Detected Network sniffing detected in Cloud environment Object versioning was disabled Okta API Token Created Okta User Session Impersonation Okta account unlock by admin Okta admin privilege assignment OneDrive file download OneDrive file upload OneDrive folder creation Owner added to Azure application Owner was added to Azure application PIM privilege member removal Penetration testing tool activity attempt Penetration testing tool attempt Possible LDAP Enumeration Tool Usage Potential Okta access limit breach Privileged role used by Azure application Rare DLP rule match by user Remote usage of AWS Lambda's role Remote usage of VM Service Account token Remote usage of an App engine Service Account token Removal of an Azure Owner from an Application or Service Principal S3 configuration deletion SaaS suspicious external domain user activity SharePoint Site Collection admin group addition Soft delete of cloud storage configuration was disabled Successful unusual guest user invitation Suspicious cloud compute instance ssh keys modification attempt Unusual AWS systems manager activity Unusual Conditional Access operation for an identity Unusual IAM enumeration activity by a non-user Identity Unusual Identity and Access Management (IAM) activity Unusual certificate management activity Unusual cloud identity impersonation Unusual exec into a Kubernetes Pod Unusual key management activity Unusual resource access by Azure application Unusual resource modification by newly seen IAM user Unusual resource modification/creation Unusual secret management activity Unverified domain added to Azure AD User accessed SaaS resource via anonymous link User added a new device to Okta Verify instance
Improved logic of 32 Informational Analytics Alerts	A user executed multiple LDAP enumeration queries A user observed and reported unusual activity in Okta Abnormal Allocation of compute resources in multiple regions Allocation of multiple cloud compute resources An Azure identity performed multiple actions that were denied An identity performed a suspicious download of multiple cloud storage objects Azure enumeration activity using Microsoft Graph API Azure high-volume data transfer Cloud infrastructure enumeration activity Cloud user performed multiple actions that were denied Deletion of multiple cloud resources Exchange mailbox delegation permissions added External SaaS file-sharing activity IAM Enumeration sequence Kubernetes enumeration activity Mailbox enumeration activity by Azure application Massive file downloads from SaaS service Massive upload to SaaS service Microsoft OneDrive enumeration activity Microsoft SharePoint enumeration activity Microsoft Teams enumeration activity Multi region enumeration activity Multiple cloud snapshots export Multiple failed logins from a single IP Okta Reported Threat Detected Okta account unlock Okta device assignment Sensitive Exchange mail sent to external users Short-lived Azure AD user account Storage enumeration activity User accessed multiple O365 AIP sensitive files User moved Exchange sent messages to deleted items
Changed metadata of 2 Low Analytics BIOCs	An uncommon executable was remotely written over SMB to an uncommon destination NTDS.dit file written by an uncommon executable
Changed metadata of an Informational Analytics BIOC	First SSO access from ASN in organization
Changed metadata of an Informational Analytics Alert	Multiple SSO MFA attempts were rejected by a user
Temporarily removed a Informational Analytics BIOC for improvement	Abnormal Recurring Communications to a Rare IP