Analytics Content Version: 2025.04.16 - Content Update Release Notes - Cortex XDR - Cortex

Release date: 28 April, 2025

Change type	Changes
Added a new Medium Analytics BIOC	A cloud storage object was copied to a foreign cloud account
Added 6 new Low Analytics BIOCs	A Backup vault policy was modified AWS S3 bucket was exposed to public access Authentication attempt by a honey user GCP data asset shared public Unusual CIM repository file access Unusual CertLog Remote File Write
Added a new Low Analytics Alert	User added to the SMS Admins local group
Added 5 new Informational Analytics BIOCs	A process connected to rare external host Key credential attribute modification Privileged certificate request via certificate template Suspicious successful RDP connection to localhost Vulnerable certificate template loaded
Added a new Informational Analytics Alert	Abnormal File Activity in SCCMContentLib Shared Folder by user
Improved logic of a High Analytics Alert	Possible brute force or configuration change attempt on cytool
Improved logic of 5 Medium Analytics BIOCs	Phantom DLL Loading Uncommon DLL-sideloading from a logical CD-ROM (ISO) device Unsigned process injecting into a Windows system binary with no command line Windows Installer exploitation for local privilege escalation Windows LOLBIN executable connected to a rare external host
Improved logic of a Medium Analytics Alert	EMAIL BETA - Multiple risk indicators detected in email
Improved logic of 27 Low Analytics BIOCs	A rare file path was added to the AppInit_DLLs registry value A suspicious direct syscall was executed AURL - An email was sent from a malicious domain AURL - Email contains URL(s) classified as inappropriate AURL - Email was sent from a domain classified as inappropriate Abnormal network communication through TOR using an uncommon port EMAIL BETA - Email containing a link with an IP address convention was detected EMAIL BETA - Email mimics replies or forwards without an actual ongoing conversation EMAIL BETA - Email was received from an unknown sender using a disposable domain EMAIL BETA - External email display name impersonation of internal personnel EMAIL BETA - Unpopular domains detected in email URLs for a recipient EMAIL BETA - Unusual hostname for the sending mail server in the email headers EMAIL BETA - Usage of homograph characters detected in an email's from header Known service display name with uncommon image-path Known service name with an uncommon image-path Microsoft Office injects code into a process Possible DLL Hijack into a Microsoft process Possible DLL Search Order Hijacking Rare SSH Session Rare Windows Remote Management (WinRM) HTTP Activity Rare security product signed executable executed in the network Sensitive browser credential files accessed by a rare non browser process Suspicious module load using direct syscall Uncommon NtWriteVirtualMemoryRemote API invocation with a PE header buffer Unsigned and unpopular process performed a DLL injection Unsigned and unpopular process performed an injection Unusual Encrypting File System Remote call (EFSRPC) to domain controller
Improved logic of 4 Low Analytics Alerts	EMAIL BETA - Potential employee impersonation in email with suspicious theme or sentiment Impossible traveler - SSO Impossible traveler - VPN Logs were not collected from a data source for an abnormally long time
Improved logic of 45 Informational Analytics BIOCs	A possible risky login to Azure A user accessed Okta's admin application AURL - An email was received from a domain classified as risky AURL - Email contains URL(s) classified as malicious AURL - Email was received from a newly registered domain AURL - URL(s) classified as risky have been detected within Email AURL - Unpopular domain(s) detected in an email's URL(s) Authentication method added to an Azure account Azure Temporary Access Pass (TAP) registered to an account Browser bookmark files accessed by a rare non-browser process EMAIL BETA - Email Punycode characters in URL EMAIL BETA - Email attachment with a potentially malicious file extension EMAIL BETA - Email attachment with multiple extensions EMAIL BETA - Email attachment(s) with potentially malicious MIME type EMAIL BETA - Email containing a redirected link EMAIL BETA - Email has a short body or subject and was sent from an external source EMAIL BETA - Email marked as spam and bulk based on Spam Confidence Level and Bulk Complaint Level values EMAIL BETA - Email message contains text hiding attributes EMAIL BETA - Email suspicious Moniker link detected EMAIL BETA - Email was received from an unknown sender using a public provider domain EMAIL BETA - Email was received from an unknown sender using a recognized domain EMAIL BETA - Email with URL shortener detected EMAIL BETA - Rarely seen URL(s) within a well-known domain detected in your organization's email EMAIL BETA - Suspicious Unicode character detected in email EMAIL BETA - Unpopular URL domain(s) in your organization detected in email EMAIL BETA - Unpopular URL(s) detected in email EMAIL BETA - Usage of homograph characters detected in an email EMAIL BETA - Well-known brand impersonation within an email's from address domain EMAIL BETA - X-Forefront-Antispam-Report has flagged this email as a potential threat Globally uncommon image load from a signed process Globally uncommon injection from a signed process Identity assigned an Azure AD Administrator Role Injection into rundll32.exe LOLBAS executable injects into another process Penetration testing tool attempt Possible DLL Side-Loading Possible LDAP Enumeration of Microsoft Configuration Manager Rare WinRM Session Remote usage of AWS Lambda's role Signed process performed an unpopular DLL injection Signed process performed an unpopular injection Uncommon communication to an instant messaging server Uncommon driver loaded Uncommon net localgroup execution Unusual ADConnect database file access
Improved logic of 9 Informational Analytics Alerts	A user established an SMB connection to multiple hosts EMAIL BETA - Elevated alert triggered by combined alerts and severity EMAIL BETA - Suspicious theme and sentiment in email External Login Password Spray Internal Login Password Spray Okta account reset password attempt Okta account unlock Possible Brute-Force attempt VPN login Brute-Force attempt
Changed metadata of a High Analytics Alert	Suspicious objects encryption in an AWS bucket
Changed metadata of a Medium Analytics BIOC	Cloud snapshot of a database or storage instance was publicly shared
Changed metadata of a Medium Analytics Alert	EMAIL BETA - Potential brand impersonation in email
Changed metadata of 3 Low Analytics BIOCs	AWS data asset shared public Disable encryption operations Discovery of accounts with pre-authentication disabled via LDAP
Changed metadata of 2 Low Analytics Alerts	Excessive user account lockouts Suspicious identity downloaded multiple objects from a bucket
Changed metadata of 31 Informational Analytics BIOCs	A cloud snapshot was created or modified A cloud storage configuration was modified AWS EC2 instance exported into S3 AWS RDS cluster deletion Abnormal Communication to a Rare Domain An AWS EFS File-share mount was deleted An AWS EFS file-share was deleted An AWS ElastiCache security group was created An AWS ElastiCache security group was modified or deleted An AWS RDS Global Cluster Deletion An AWS RDS instance was created from a snapshot An AWS S3 bucket configuration was modified An AWS database service master user password was changed Aurora DB cluster stopped Azure Blob Container Access Level Modification Azure Storage Account key generated Azure storage account blob anonymous access is enabled Azure storage account cross-tenant object replication was enabled Azure storage account was publicly shared Cloud resource logging was disabled Cloud storage automatic backup disabled Cloud storage delete protection disabled Data encryption was disabled EC2 snapshot attribute has been modified GCP Logging Bucket Deletion GCP Storage Bucket Configuration Modification GCP Storage Bucket Permissions Modification GCP Storage Bucket deletion Object versioning was disabled S3 configuration deletion Soft delete of cloud storage configuration was disabled
Changed metadata of 3 Informational Analytics Alerts	An identity performed a suspicious download of multiple cloud storage objects Multiple cloud snapshots export Storage enumeration activity
Removed 4 old Medium Analytics Alerts	EMAIL BETA - Potential evasion techniques detected in email EMAIL BETA - Potentially dangerous URL(s) in email EMAIL BETA - Potentially dangerous sender EMAIL BETA - Potentially malicious attachment(s) spotted in an email
Removed an old Informational Analytics BIOC	EMAIL BETA - Email contains potentially malicious attachments that are not blocked by default
Removed an old Informational Analytics Alert	EMAIL BETA - Email identified as potential fraud attempt
Temporarily removed a High Analytics BIOC for improvement	Possible DCShadow attempt
Temporarily removed a Medium Analytics BIOCs for improvement	Executable moved to Windows system folder Office process spawned with suspicious command-line arguments