Analytics Content Version: 2025.01.29 - Content Update Release Notes - Cortex XDR - Cortex

Release date: 10 February, 2025

Change type	Changes
Added 2 new Informational Analytics BIOCs	Azure storage account blob anonymous access is enabled Azure storage account was publicly shared
Improved logic of a High Analytics BIOC	Memory dumping with comsvcs.dll
Improved logic of a High Analytics Alert	Suspicious objects encryption in an AWS bucket
Improved logic of 3 Medium Analytics BIOCs	Phantom DLL Loading Possible Microsoft process masquerading Windows LOLBIN executable connected to a rare external host
Improved logic of 4 Low Analytics BIOCs	Possible DLL Hijack into a Microsoft process Possible DLL Search Order Hijacking Suspicious modification of the AdminSDHolder's ACL Uncommon remote monitoring and management tool
Improved logic of 2 Low Analytics Alerts	Logs were not collected from a data source for an abnormally long time Suspicious identity downloaded multiple objects from a bucket
Improved logic of 10 Informational Analytics BIOCs	A cloud snapshot was created or modified Globally uncommon high entropy process was executed Globally uncommon image load from a signed process LDAP traffic from non-standard process Possible DLL Side-Loading Rare Unix process divided files by size Rare signature signed executable executed in the network Remote usage of VM Service Account token Suspicious access to shadow file Unusual process accessed web browser credentials
Improved logic of 3 Informational Analytics Alerts	An identity performed a suspicious download of multiple cloud storage objects Multiple TGT requests for users without Kerberos pre-authentication SSO Password Spray
Increased the severity to Medium for an Analytics BIOC	Unusual process access to ld.so.preload file
Changed metadata of a Medium Analytics BIOC	Reverse SSH tunnel to external domain/ip
Changed metadata of a Low Analytics BIOC	Uncommon SSH session was established
Changed metadata of 2 Informational Analytics BIOCs	AppleScript executed a shell script AppleScript process executed with a rare command line
Temporarily removed a Low Analytics BIOC for improvement	Conhost.exe spawned a suspicious cmd process