Analytics Content Version: 2025.03.26 - Content Update Release Notes - Cortex XDR - Cortex

Release date: 21 April, 2025

Change type	Changes
Added 2 new Low Analytics BIOCs	Certipy AD CS enumeration via LDAP Suspicious access of the System Management Container
Added 3 new Informational Analytics BIOCs	Cloud resource logging was disabled PKINIT TGT authentication request Uncommon shell command execution
Improved logic of 5 High Analytics BIOCs	A Successful VPN connection from TOR A Successful login from TOR A successful SSO sign-in from TOR Suspicious API call from a Tor exit node Suspicious SaaS API call from a Tor exit node
Improved logic of a High Analytics Alert	Suspicious objects encryption in an AWS bucket
Improved logic of 17 Medium Analytics BIOCs	A Kubernetes API operation was successfully invoked by an anonymous user A Kubernetes dashboard service account was used outside the cluster A machine certificate was issued with a mismatch A mail forwarding rule was configured in Google Workspace Azure AD PIM alert disabled Cloud snapshot of a database or storage instance was publicly shared Kubernetes vulnerability scanning tool usage Machine account was added to a domain admins group Penetration testing tool activity Service ticket request with a spoofed sAMAccountName Suspicious authentication with Azure Password Hash Sync user Suspicious heavy allocation of compute resources - possible mining activity Suspicious hidden user created Suspicious usage of EC2 token TGT request with a spoofed sAMAccountName - Event log TGT request with a spoofed sAMAccountName - Network Windows LOLBIN executable connected to a rare external host
Improved logic of 6 Medium Analytics Alerts	A new machine attempted Kerberos delegation Kerberos User Enumeration NTLM Hash Harvesting Possible AS-REP Roasting Attack Possible Kerberoasting attack Random-Looking Domain Names
Improved logic of 65 Low Analytics BIOCs	A Command Line Interface (CLI) command was executed from a GCP serverless compute service A Command Line Interface (CLI) command was executed from an AWS serverless compute service A GCP service account was delegated domain-wide authority in Google Workspace A cloud function was created with an unusual runtime A computer account was promoted to DC A disabled user attempted to log in to a VPN A domain was added to the trusted domains list A process queried the ADFS database decryption key via LDAP A user attempted to bypass Okta MFA A user modified the CA audit policy AWS Flow Logs deletion AWS Guard-Duty detector deletion AWS data asset shared public AWS network ACL rule deletion AWS web ACL deletion An Azure Firewall policy deletion Azure AD PIM role settings change Azure Event Hub Deletion Azure Network Watcher Deletion Azure account deletion by a non-standard account Azure domain federation settings modification attempt Billing admin role was removed Cloud Trail logging deletion Conditional Access policy removed Disable encryption operations Discovery of accounts with pre-authentication disabled via LDAP EMAIL BETA - Email was received from an unknown sender using a disposable domain EMAIL BETA - External email display name impersonation of internal personnel Exchange DKIM signing configuration disabled Exchange Safe Attachment policy disabled or removed Exchange Safe Link policy disabled or removed Exchange anti-phish policy disabled or removed Exchange audit log disabled Exchange mailbox audit bypass Exchange malware filter policy removed Exchange transport forwarding rule configured Exchange user mailbox forwarding First Azure AD PowerShell operation for a user GCP Logging Sink Deletion Interactive login by a service account Kubernetes pod creation from unknown container image registry Login attempt by a honey user MFA Disabled for Google Workspace MFA was disabled for an Azure identity Masquerading as a default local account Okta Reported Attack Suspected Possible Pass-the-Hash Recurring access to rare IP Recurring rare domain access from an unsigned process Remote usage of an AWS service token Remote usage of an Azure Managed Identity token Remote usage of an Azure Service Principal token SPNs cleared from a machine account SSO authentication attempt by a honey user SSO authentication by a machine account SSO authentication by a service account Scripting engine connected to a rare external host Suspicious Print System Remote Protocol usage by a process Suspicious modification of the AdminSDHolder's ACL Suspicious sAMAccountName change Unusual Azure AD sync module load Unusual cross projects activity User set insecure CA registry setting for global SANs VPN login attempt by a honey user VPN login by a service account
Improved logic of 23 Low Analytics Alerts	A user connected a new USB storage device to multiple hosts A user rejected an SSO request from an unusual country A user sent multiple TGT requests to irregular service A user uploaded malware to SharePoint or OneDrive Account probing An identity dumped multiple secrets from a project DNS Tunneling Excessive user account lockouts Failed DNS Impossible traveler - SSO Impossible traveler - VPN Interactive local account enumeration Logs were not collected from a data source for an abnormally long time Multiple Azure AD admin role removals Multiple Rare LOLBIN Process Executions by User Multiple suspicious user accounts were created NTLM Brute Force on a Service Account NTLM Brute Force on an Administrator Account New Shared User Account Possible external RDP Brute-Force Short-lived user account Suspicious identity downloaded multiple objects from a bucket User collected remote shared files in an archive
Improved logic of 334 Informational Analytics BIOCs	A Google Workspace Role privilege was deleted A Google Workspace identity created, assigned or modified a role A Google Workspace identity performed an unusual admin console activity A Google Workspace identity used the security investigation tool A Google Workspace service was configured as unrestricted A Google Workspace user was added to a group A Google Workspace user was removed from a group A Kubernetes ConfigMap was created or deleted A Kubernetes Cronjob was created A Kubernetes DaemonSet was created A Kubernetes Pod was created with a sidecar container A Kubernetes Pod was deleted A Kubernetes ReplicaSet was created A Kubernetes StatefulSet was created A Kubernetes cluster role binding was created or deleted A Kubernetes cluster was created or deleted A Kubernetes deployment was created A Kubernetes ephemeral container was created A Kubernetes namespace was created or deleted A Kubernetes node service account activity from external IP A Kubernetes role binding was created or deleted A Kubernetes secret was created or deleted A Kubernetes service account executed an unusual API call A Kubernetes service account has enumerated its permissions A Kubernetes service account was created or deleted A Kubernetes service was created or deleted A New Server was Added to an Azure Active Directory Hybrid Health ADFS Environment A Service Principal was created in Azure A Service Principal was removed from Azure A browser was opened in private mode A cloud identity created or modified a security group A cloud identity executed an API call from an unusual country A cloud identity had escalated its permissions A cloud identity invoked IAM related persistence operations A cloud instance was stopped A cloud snapshot was created or modified A cloud storage configuration was modified A compute-attached identity executed API calls outside the instance's region A container registry was created or deleted A disabled user attempted to authenticate via SSO A disabled user attempted to log in A possible risky login to Azure A process connected to a rare external host A rare local administrator login A suspicious process queried AD CS objects via LDAP A third-party application was authorized to access the Google Workspace APIs A third-party application's access to the Google Workspace domain's resources was revoked A user accessed Okta's admin application A user accessed an uncommon AppID A user account was modified to password never expires A user added a Windows firewall rule A user certificate was issued with a mismatch A user changed the Windows system time A user connected a USB storage device for the first time A user connected a new USB storage device to a host A user connected from a new country A user connected to a VPN from a new country A user created a pfx file for the first time A user created an abnormal password-protected archive A user enabled a default local account A user logged in at an unusual time via SSO A user logged in at an unusual time via VPN A user logged in from an abnormal country or ASN A user logged in to the AWS console for the first time A user modified an Okta network zone A user modified an Okta policy rule A user queried AD CS objects via LDAP A user was added to a Windows security group AWS Cloud Trail log trail modification AWS CloudWatch log group deletion AWS CloudWatch log stream deletion AWS Config Recorder stopped AWS EC2 instance exported into S3 AWS IAM resource group deletion AWS RDS cluster deletion AWS Role Trusted Entity modification AWS Root account activity AWS SSM send command attempt AWS STS temporary credentials were generated AWS SecurityHub findings were modified AWS Transfer Family server created AWS config resource deletion AWS network ACL rule creation AWS user creation Abnormal Communication to a Rare Domain Abnormal User Login to Domain Controller Activity in a dormant region of a cloud project Admin privileges were granted to a Google Workspace user An AWS EFS File-share mount was deleted An AWS EFS file-share was deleted An AWS EKS cluster was created or deleted An AWS ElastiCache security group was created An AWS ElastiCache security group was modified or deleted An AWS GuardDuty IP set was created An AWS Lambda Function was created An AWS Lambda function was modified An AWS RDS Global Cluster Deletion An AWS RDS instance was created from a snapshot An AWS Route 53 domain was transferred to another AWS account An AWS S3 bucket configuration was modified An AWS SAML provider was modified An AWS SES Email sending settings were modified An AWS SES identity was deleted An AWS database service master user password was changed An Azure Cloud Shell was Created An Azure DNS Zone was modified An Azure Firewall Rule Collection was modified An Azure Firewall was modified An Azure Key Vault key was modified An Azure Key Vault was modified An Azure Kubernetes Cluster was created or deleted An Azure Kubernetes Role or Cluster-Role was modified An Azure Kubernetes Role-Binding or Cluster-Role-Binding was modified or deleted An Azure Kubernetes Service Account was modified or deleted An Azure Network Security Group was modified An Azure Point-to-Site VPN was modified An Azure Suppression Rule was created An Azure VPN Connection was modified An Azure application reached a throttling API rate An Azure firewall rule group was modified An Azure virtual network Device was modified An Azure virtual network was modified An Email address was added to AWS SES An IAM group was created An app was added to Google Marketplace An app was added to the Google Workspace trusted OAuth apps list An app was removed from a blocked list in Google Workspace An identity accessed Azure Kubernetes Secrets An identity attached an administrative policy to an IAM user/role An identity created or updated password for an IAM user An identity disabled bucket logging An identity started an AWS SSM session An identity was granted permissions to manage user access to Azure resources An operation was performed by an identity from a domain that was not seen in the organization An unusual archive file creation by a user Attempted Azure application access from unknown tenant Aurora DB cluster stopped Authentication method added to an Azure account Authentication method was added to Azure account Azure AD PIM elevation request Azure AD account unlock/password reset attempt Azure Automation Account Creation Azure Automation Runbook Creation/Modification Azure Automation Runbook Deletion Azure Automation Webhook creation Azure Blob Container Access Level Modification Azure Event Hub Authorization rule creation/modification Azure Key Vault Secrets were modified Azure Key Vault modification Azure Kubernetes events were deleted Azure Resource Group Deletion Azure Service principal/Application creation Azure Storage Account key generated Azure Temporary Access Pass (TAP) registered to an account Azure account creation by a non-standard account Azure application URI modification Azure application consent Azure application credentials added Azure application removed Azure audit - MFA fraud reported Azure conditional access policy creation or modification Azure device code authentication flow used Azure diagnostic configuration deletion Azure group creation/deletion Azure mailbox rule creation Azure permission delegation granted Azure service principal assigned app role Azure storage account blob anonymous access is enabled Azure storage account cross-tenant object replication was enabled Azure storage account was publicly shared Azure user creation/deletion Azure user password reset Azure virtual machine commands execution BitLocker key retrieval Cloud Organizational policy was created or modified Cloud Trail Logging has been stopped/suspended Cloud Watch alarm deletion Cloud compute instance user data script modification Cloud compute serial console access Cloud email service activity Cloud identity reached a throttling API rate Cloud impersonation attempt by unusual identity type Cloud storage automatic backup disabled Cloud storage delete protection disabled Cloud unusual access key creation Credentials were added to Azure application DLP sensitive data exposed to external users Data Sharing between GCP and Google Workspace was disabled Data encryption was disabled Deletion of AD CS certificate database entries Denied API call by a Kubernetes service account Device Registration Policy modification EC2 snapshot attribute has been modified EMAIL BETA - Email attachment with a potentially malicious file extension EMAIL BETA - Email attachment(s) with potentially malicious MIME type EMAIL BETA - Email containing a redirected link EMAIL BETA - Email has a short body or subject and was sent from an external source EMAIL BETA - Email was received from an unknown sender using a public provider domain EMAIL BETA - Email was received from an unknown sender using a recognized domain EMAIL BETA - Suspicious Unicode character detected in email EMAIL BETA - Usage of homograph characters detected in an email EMAIL BETA - Well-known brand impersonation within an email's from address domain Exchange compliance search created Exchange email-hiding inbox rule Exchange email-hiding transport rule Exchange inbox forwarding rule configured Exchange mailbox folder permission modification External Sharing was turned on for Google Drive External user invitation to Azure tenant First SSO Resource Access in the Organization First SSO access from ASN for user First SSO access from ASN in organization First VPN access attempt from a country in organization First VPN access from ASN for user First VPN access from ASN in organization First connection from a country in organization GCP Firewall Rule Modification GCP Firewall Rule creation GCP IAM Custom Role Creation GCP IAM Role Deletion GCP IAM Service Account Key Deletion GCP Logging Bucket Deletion GCP Logging Sink Modification GCP Pub/Sub Subscription Deletion GCP Pub/Sub Topic Deletion GCP Service Account Disable GCP Service Account creation GCP Service Account deletion GCP Service Account key creation GCP Storage Bucket Configuration Modification GCP Storage Bucket Permissions Modification GCP Storage Bucket deletion GCP VPC Firewall Rule Deletion GCP Virtual Private Cloud (VPC) Network Deletion GCP Virtual Private Network Route Creation GCP Virtual Private Network Route Deletion GCP set IAM policy activity Gmail delegation was turned on for the organization Gmail routing settings changed Google Marketplace restrictions were modified Google Workspace organizational unit was modified Google Workspace third-party application's security settings were changed Granting Access to an Account IAM User added to an IAM group Identity assigned an Azure AD Administrator Role Interactive login by a machine account Interactive login from a shared user account Kubernetes Pod Created With Sensitive Volume Kubernetes Pod Created with host Inter Process Communications (IPC) namespace Kubernetes Pod created with host process ID (PID) namespace Kubernetes Privileged Pod Creation Kubernetes admission controller activity Kubernetes cluster events deletion Kubernetes network policy modification Kubernetes pod creation with host network Kubernetes service account activity outside the cluster Local user account creation Login by a dormant user MFA device was removed/deactivated from an IAM user Member added to a Windows local security group Microsoft 365 DLP policy disabled or removed Modification or Deletion of an Azure Application Gateway Detected Network sniffing detected in Cloud environment Object versioning was disabled Okta API Token Created Okta User Session Impersonation Okta account unlock by admin Okta admin privilege assignment OneDrive file download OneDrive file upload OneDrive folder creation Owner added to Azure application Owner was added to Azure application PIM privilege member removal Penetration testing tool activity attempt Penetration testing tool attempt Possible GPO Enumeration Possible LDAP Enumeration Tool Usage Possible LDAP Enumeration of Microsoft Configuration Manager Possible SPN enumeration Potential Okta access limit breach Privileged role used by Azure application Rare AppID usage to a rare destination Rare DLP rule match by user Rare LOLBIN Process Execution by User Rare NTLM Access By User To Host Rare NTLM Usage by User Rare machine account creation Rare process execution by user Rare process execution in organization Remote usage of AWS Lambda's role Remote usage of VM Service Account token Remote usage of an App engine Service Account token Removal of an Azure Owner from an Application or Service Principal S3 configuration deletion SSO with abnormal operating system SSO with abnormal user agent SSO with new operating system SaaS suspicious external domain user activity Sensitive account password reset attempt SharePoint Site Collection admin group addition Soft delete of cloud storage configuration was disabled Successful unusual guest user invitation Suspicious Azure AD interactive sign-in using PowerShell Suspicious External RDP Login Suspicious NTLM authentication with machine account Suspicious SSO access from ASN Suspicious SSO authentication Suspicious cloud compute instance ssh keys modification attempt Suspicious domain user account creation Unusual AWS systems manager activity Unusual Conditional Access operation for an identity Unusual IAM enumeration activity by a non-user Identity Unusual Identity and Access Management (IAM) activity Unusual certificate management activity Unusual cloud identity impersonation Unusual exec into a Kubernetes Pod Unusual key management activity Unusual resource access by Azure application Unusual resource modification by newly seen IAM user Unusual resource modification/creation Unusual secret management activity Unusual user account enablement Unusual user account unlock Unusual weak authentication by user Unverified domain added to Azure AD User accessed SaaS resource via anonymous link User account delegation change User added SID History to an account User added a new device to Okta Verify instance User attempted to connect from a suspicious country VPN access with an abnormal operating system VPN login by a dormant user VPN login with a machine account
Improved logic of 72 Informational Analytics Alerts	A user accessed an abnormal number of files on a remote shared folder A user accessed an abnormal number of remote shared folders A user accessed multiple time-consuming websites A user accessed multiple unusual resources via SSO A user authenticated with weak NTLM to multiple hosts A user established an SMB connection to multiple hosts A user executed multiple LDAP enumeration queries A user logged on to multiple workstations via Schannel A user observed and reported unusual activity in Okta A user performed suspiciously massive file activity A user printed an unusual number of files A user received multiple weakly encrypted service tickets A user requested multiple service tickets A user took numerous screenshots Abnormal Allocation of compute resources in multiple regions Allocation of multiple cloud compute resources An Azure identity performed multiple actions that were denied An identity performed a suspicious download of multiple cloud storage objects Azure enumeration activity using Microsoft Graph API Azure uncommon increase in API request sizes Brute-force attempt on a local account Cloud infrastructure enumeration activity Cloud user performed multiple actions that were denied Deletion of multiple cloud resources Exchange mailbox delegation permissions added External Login Password Spray External SaaS file-sharing activity IAM Enumeration sequence Increase in Job-Related Site Visits Intense SSO failures Internal Login Password Spray Kubernetes enumeration activity Mailbox enumeration activity by Azure application Massive file activity abnormal to process Massive file compression by user Massive file downloads from SaaS service Massive upload to SaaS service Massive upload to a rare storage or mail domain Microsoft OneDrive enumeration activity Microsoft OneNote enumeration activity Microsoft SharePoint enumeration activity Microsoft Teams enumeration activity Multi region enumeration activity Multiple Okta MFA requests sent to a user Multiple Rare Process Executions in Organization Multiple TGT requests for users without Kerberos pre-authentication Multiple cloud snapshots export Multiple failed logins from a single IP Multiple user accounts were deleted Multiple users authenticated with weak NTLM to a host NTLM Brute Force NTLM Password Spray Okta Reported Threat Detected Okta account reset password attempt Okta account unlock Okta device assignment Possible Brute-Force attempt Possible TGT reuse from different hosts (pass the ticket) Possible data exfiltration over a USB storage device Possible internal data exfiltration over a USB storage device Remote account enumeration SSH authentication brute force attempts SSO Brute Force SSO Password Spray Sensitive Exchange mail sent to external users Short-lived Azure AD user account Storage enumeration activity Suspicious DNS traffic User accessed multiple O365 AIP sensitive files User added to a group and removed User moved Exchange sent messages to deleted items VPN login Brute-Force attempt
Changed metadata of an Informational Analytics BIOC	Unusual DB process spawning a shell