Analytics Content Version: 2025.03.12 - Content Update Release Notes - Cortex XDR - Cortex

Release date: 7 April, 2025

Change type	Changes
Added a new Medium Analytics Alert	Possible AS-REP Roasting Attack
Added a new Low Analytics BIOC	A user modified the CA audit policy
Added a new Informational Analytics BIOC	A possible risky login to Azure
Added a new Informational Analytics Alert	Multiple Okta MFA requests sent to a user
Improved logic of a High Analytics BIOC	A successful SSO sign-in from TOR
Improved logic of a Medium Analytics BIOC	Cloud snapshot of a database or storage instance was publicly shared
Improved logic of 5 Medium Analytics Alerts	EMAIL BETA - Multiple risk indicators detected in email EMAIL BETA - Potential evasion techniques detected in email EMAIL BETA - Potentially dangerous URL(s) in email EMAIL BETA - Potentially dangerous sender EMAIL BETA - Potentially malicious attachment(s) spotted in an email
Improved logic of 11 Low Analytics BIOCs	AWS Flow Logs deletion AWS data asset shared public Cloud Trail logging deletion Executable or Script file written by a web server process LOLBIN process executed with a high integrity level Possible webshell file written by a web server process SSO authentication attempt by a honey user SSO authentication by a machine account SSO authentication by a service account Suspicious process accessed certificate files Unusual cross projects activity
Improved logic of 4 Low Analytics Alerts	A user rejected an SSO request from an unusual country An identity dumped multiple secrets from a project Impossible traveler - SSO Logs were not collected from a data source for an abnormally long time
Improved logic of 52 Informational Analytics BIOCs	A Kubernetes ConfigMap was created or deleted A Kubernetes Cronjob was created A Kubernetes cluster role binding was created or deleted A Kubernetes cluster was created or deleted A Kubernetes ephemeral container was created A Kubernetes namespace was created or deleted A Kubernetes role binding was created or deleted A Kubernetes secret was created or deleted A Kubernetes service account was created or deleted A Kubernetes service was created or deleted A cloud identity created or modified a security group A cloud identity executed an API call from an unusual country A cloud identity had escalated its permissions A cloud identity invoked IAM related persistence operations A cloud instance was stopped A cloud snapshot was created or modified A container registry was created or deleted A disabled user attempted to authenticate via SSO A user connected from a new country A user logged in at an unusual time via SSO AWS Transfer Family server created Activity in a dormant region of a cloud project An identity attached an administrative policy to an IAM user/role Azure storage account blob anonymous access is enabled Azure storage account was publicly shared Cloud compute instance user data script modification Cloud compute serial console access Cloud identity reached a throttling API rate Data encryption was disabled Deletion of AD CS certificate database entries EMAIL BETA - Email attachment with multiple extensions Exchange mailbox folder permission modification First SSO Resource Access in the Organization First SSO access from ASN for user First SSO access from ASN in organization First connection from a country in organization Globally uncommon high entropy process was executed Globally uncommon process execution from a signed process Kubernetes cluster events deletion Kubernetes network policy modification Network sniffing detected in Cloud environment Possible LDAP Enumeration of Microsoft Configuration Manager SSO with abnormal user agent SSO with new operating system Suspicious SSO access from ASN Unusual ADConnect database file access Unusual AWS systems manager activity Unusual Identity and Access Management (IAM) activity Unusual cloud identity impersonation Unusual resource modification by newly seen IAM user Unusual resource modification/creation User attempted to connect from a suspicious country
Improved logic of 14 Informational Analytics Alerts	A user accessed multiple unusual resources via SSO An identity performed a suspicious download of multiple cloud storage objects Cloud infrastructure enumeration activity Deletion of multiple cloud resources EMAIL BETA - Elevated alert triggered by combined alerts and severity IAM Enumeration sequence Intense SSO failures Kubernetes enumeration activity Massive file downloads from SaaS service Multi region enumeration activity Multiple failed logins from a single IP SSO Brute Force SSO Password Spray Storage enumeration activity
Decreased the severity to Low for 2 Analytics BIOCs	Suspicious disablement of the Windows Firewall Uncommon reverse SSH tunnel to external domain/ip
Changed metadata of a Low Analytics BIOC	Remote usage of an Azure Managed Identity token
Changed metadata of a Low Analytics Alert	Possible external RDP Brute-Force
Changed metadata of 2 Informational Analytics Alerts	External Login Password Spray Possible Brute-Force attempt
Removed an old Informational Analytics Alert	Multiple SSO MFA attempts were rejected by a user