Analytics Content Version: 2025.02.26 - Content Update Release Notes - Cortex XDR - Cortex

Release date: 17 March, 2025

Change type	Changes
Added 6 new Medium Analytics Alerts	EMAIL BETA - Multiple risk indicators detected in email EMAIL BETA - Potential brand impersonation in email EMAIL BETA - Potential evasion techniques detected in email EMAIL BETA - Potentially dangerous URL(s) in email EMAIL BETA - Potentially dangerous sender EMAIL BETA - Potentially malicious attachment(s) spotted in an email
Added 11 new Low Analytics BIOCs	AWS data asset shared public EMAIL BETA - An email was sent from a malicious domain EMAIL BETA - Email containing a link with an IP address convention was detected EMAIL BETA - Email contains URL(s) classified as inappropriate EMAIL BETA - Email mimics replies or forwards without an actual ongoing conversation EMAIL BETA - Email received from an unknown sender using a disposable email address EMAIL BETA - Email was sent from a domain classified as inappropriate EMAIL BETA - External email display name impersonation of internal personnel EMAIL BETA - Unpopular domains detected in email URLs for a recipient EMAIL BETA - Unusual hostname for the sending mail server in the email headers EMAIL BETA - Usage of homograph characters detected in an email's from header
Added a new Low Analytics Alert	EMAIL BETA - Potential employee impersonation in email with financial or urgent context
Added 30 new Informational Analytics BIOCs	Azure audit - MFA fraud reported EMAIL BETA - An email was received from a domain classified as risky EMAIL BETA - Email Punycode characters in URL EMAIL BETA - Email attachment with a potentially malicious file extension EMAIL BETA - Email attachment with multiple extensions EMAIL BETA - Email attachment(s) with potentially malicious MIME type EMAIL BETA - Email containing a redirected link EMAIL BETA - Email containing financial content was received from an external domain EMAIL BETA - Email containing urgency terms was received from an external domain EMAIL BETA - Email contains URL(s) classified as malicious EMAIL BETA - Email contains potentially malicious attachments that are not blocked by default EMAIL BETA - Email has a short body or subject and was sent from an external source EMAIL BETA - Email marked as spam and bulk based on Spam Confidence Level and Bulk Complaint Level values EMAIL BETA - Email message contains text hiding attributes EMAIL BETA - Email received from an unknown sender using a public provider email address EMAIL BETA - Email suspicious Moniker link detected EMAIL BETA - Email was received from a newly registered domain EMAIL BETA - Email was received from an unknown sender address EMAIL BETA - Email with URL shortener detected EMAIL BETA - Rarely seen URL(s) within a well-known domain detected in your organization's email EMAIL BETA - Suspicious Unicode character detected in email EMAIL BETA - URL(s) classified as risky have been detected within Email EMAIL BETA - Unpopular URL domain(s) in your organization detected in email EMAIL BETA - Unpopular URL(s) detected in email EMAIL BETA - Unpopular domain(s) detected in an email's URL(s) EMAIL BETA - Usage of homograph characters detected in an email EMAIL BETA - Well-known brand impersonation within an email's from address domain EMAIL BETA - X-Forefront-Antispam-Report has flagged this email as a potential threat Uncommon driver loaded Unusual user account enablement
Added 4 new Informational Analytics Alerts	EMAIL BETA - Elevated alert triggered by combined alerts and severity EMAIL BETA - Email identified as potential fraud attempt EMAIL BETA - Suspicious theme and sentiment in email Kubernetes environment enumeration activity
Improved logic of a High Analytics BIOC	Collection error
Improved logic of a Medium Analytics BIOC	Cloud snapshot of a database or storage instance was publicly shared
Improved logic of 11 Low Analytics BIOCs	AWS Flow Logs deletion Azure Event Hub Deletion Cloud Trail logging deletion Possible DCSync from a non domain controller Uncommon local scheduled task creation via schtasks.exe Unusual Encrypting File System Remote call (EFSRPC) to domain controller Unusual cross projects activity Unusual process accessed FTP Client credentials Unusual process accessed a crypto wallet's files Unusual process accessed a messaging app's files Unusual process accessed a web browser history file
Improved logic of 2 Low Analytics Alerts	An identity dumped multiple secrets from a project Logs were not collected from a data source for an abnormally long time
Improved logic of 54 Informational Analytics BIOCs	A Kubernetes ConfigMap was created or deleted A Kubernetes Cronjob was created A Kubernetes cluster role binding was created or deleted A Kubernetes cluster was created or deleted A Kubernetes ephemeral container was created A Kubernetes namespace was created or deleted A Kubernetes role binding was created or deleted A Kubernetes secret was created or deleted A Kubernetes service account executed an unusual API call A Kubernetes service account was created or deleted A Kubernetes service was created or deleted A cloud identity created or modified a security group A cloud identity executed an API call from an unusual country A cloud identity had escalated its permissions A cloud identity invoked IAM related persistence operations A cloud instance was stopped A cloud snapshot was created or modified A container registry was created or deleted A user created an abnormal password-protected archive A user modified an Okta network zone Activity in a dormant region of a cloud project An Azure application reached a throttling API rate An identity attached an administrative policy to an IAM user/role Azure Temporary Access Pass (TAP) registered to an account Azure application credentials added Azure storage account blob anonymous access is enabled Azure storage account was publicly shared Cloud compute instance user data script modification Cloud compute serial console access Cloud identity reached a throttling API rate Cloud impersonation attempt by unusual identity type Data encryption was disabled Exchange email-hiding inbox rule Globally uncommon high entropy module was loaded Globally uncommon high entropy process was executed Kubernetes admission controller activity Kubernetes cluster events deletion Kubernetes network policy modification Network sniffing detected in Cloud environment Possible LDAP Enumeration Tool Usage Potential Okta access limit breach Rare Remote Service (SVCCTL) RPC activity Rare Scheduled Task RPC activity Rare process accessed a Keychain file Unusual AWS systems manager activity Unusual Identity and Access Management (IAM) activity Unusual cloud identity impersonation Unusual process accessed a macOS notes DB file Unusual process accessed web browser cookies Unusual process accessed web browser credentials Unusual resource modification by newly seen IAM user Unusual resource modification/creation Unusual user account unlock User attempted to connect from a suspicious country
Improved logic of 15 Informational Analytics Alerts	A user executed multiple LDAP enumeration queries An identity performed a suspicious download of multiple cloud storage objects Azure uncommon increase in API request sizes Cloud infrastructure enumeration activity Deletion of multiple cloud resources External SaaS file-sharing activity IAM Enumeration sequence Internal Login Password Spray Kubernetes enumeration activity Massive file downloads from SaaS service Massive upload to SaaS service Multi region enumeration activity Multiple failed logins from a single IP SSH brute force attempt Storage enumeration activity
Increased the severity to Low for 2 Analytics BIOCs	Executable or Script file written by a web server process Possible webshell file written by a web server process
Decreased the severity to Low for an Analytics BIOC	Possible Microsoft process masquerading
Changed metadata of a Medium Analytics BIOC	Suspicious heavy allocation of compute resources - possible mining activity
Changed metadata of a Low Analytics BIOC	Copy a user's GnuPG directory with rsync
Changed metadata of a Low Analytics Alert	Excessive user account lockouts
Changed metadata of an Informational Analytics BIOC	Azure diagnostic configuration deletion
Changed metadata of 3 Informational Analytics Alerts	Abnormal Allocation of compute resources in multiple regions Allocation of multiple cloud compute resources Rare access to known advertising domains