Analytics Content Version: 2025.06.04 - Content Update Release Notes - Cortex

Release date: 18 June, 2025

Change type	Changes
Added 2 new Informational Analytics BIOCs	Potential DCSync by an unusual user Uncommon access to cloud platforms' sensitive files by a scripting engine
Improved logic of 7 High Analytics BIOCs	Copy a process memory file Memory dumping with comsvcs.dll Mimikatz command-line arguments Suspicious usage of File Server Remote VSS Protocol (FSRVP) Uncommon remote scheduled task creation Unicode RTL Override Character Unprivileged process opened a registry hive
Improved logic of 35 Medium Analytics BIOCs	A TCP stream was created directly in a shell A process was executed with a command line obfuscated by Unicode character substitution Autorun.inf created in root C drive Commonly abused AutoIT script connects to an external domain Encoded information using Windows certificate management tool Executable created to disk by lsass.exe Execution of the Hydra Linux password brute-force tool Fodhelper.exe UAC bypass Indirect command execution using the Program Compatibility Assistant Interactive at.exe privilege escalation method Kerberos Traffic from Non-Standard Process LSASS dump file written to disk Microsoft Office Process Spawning a Suspicious One-Liner Modification of NTLM restrictions in the Registry Phantom DLL Loading Possible Persistence via group policy Registry keys Possible RDP session hijacking using tscon.exe Possible code downloading from a remote host by Regsvr32 Possible collection of screen captures with Windows Problem Steps Recorder Possible malicious .NET compilation started by a commonly abused process PowerShell runs suspicious base64-encoded commands PowerShell suspicious flags Procdump executed from an atypical directory Remote WMI process execution Rundll32.exe running with no command-line arguments Rundll32.exe spawns conhost.exe Suspicious .NET process loads an MSBuild DLL Suspicious PowerSploit's recon module (PowerView) net function was executed Suspicious PowerSploit's recon module (PowerView) used to search for exposed hosts Suspicious certutil command line Uncommon DLL-sideloading from a logical CD-ROM (ISO) device Uncommon SetWindowsHookEx API invocation of a possible keylogger Unsigned process injecting into a Windows system binary with no command line Unusual process access to ld.so.preload file Windows LOLBIN executable connected to a rare external host
Improved logic of 101 Low Analytics BIOCs	A process queried the ADFS database decryption key via LDAP A remote service was created via RPC over SMB A suspicious direct syscall was executed A suspicious process enrolled for a certificate An uncommon service was started An unpopular process accessed the microphone on the host Attempt to execute a command on a remote host using PsExec.exe Cached credentials discovery with cmdkey Change of sudo caching configuration Compressing data using python Conhost.exe spawned a suspicious cmd process Copy a user's GnuPG directory with rsync Download a script using the python requests module Elevation to SYSTEM via services Executable or Script file written by a web server process Execution of an uncommon process at an early startup stage by Windows system binary Execution of an uncommon process with a local/domain user SID at an early startup stage by Windows system binary Execution of dllhost.exe with an empty command line Execution of renamed lolbin Extracting credentials from Unix files Globally uncommon root domain from a signed process Globally uncommon root-domain port combination from a signed process Image file execution options (IFEO) registry key set Installation of a new System-V service Keylogging using system commands Known service display name with uncommon image-path Known service name with an uncommon image-path LOLBIN process executed with a high integrity level Linux system firewall was modified Masquerading as the Linux crond process Microsoft Office adds a value to autostart Registry key Microsoft Office injects code into a process Microsoft Office process spawns a commonly abused process NTDS.dit file written by an uncommon executable New addition to Windows Defender exclusion list Office process accessed an unusual .LNK file Possible DLL Hijack into a Microsoft process Possible DLL Search Order Hijacking Possible Microsoft process masquerading Possible network sniffing attempt via tcpdump or tshark Possible webshell file written by a web server process Potential SCCM credential harvesting using WMI detected RDP connections enabled remotely via Registry Rare process created an SSH session to an uncommon cloud resource Rare process created an SSH session to an uncommon external host Rare process executed by an AppleScript Rare process with VNC server capabilities started Rare scheduled task created Rare service DLL was added to the registry Reading bash command history file Recurring rare domain access from an unsigned process Remote DCOM command execution Remote command execution via wmic.exe Remote service start from an uncommon source Rundll32.exe executes a rare unsigned module SUID/GUID permission discovery Scheduled Task hidden by registry modification Screensaver process executed from Users or temporary folder Scripting engine connected to a rare external host Sensitive browser credential files accessed by a rare non browser process Setuid and Setgid file bit manipulation Stored credentials exported using credwiz.exe Suspicious Certutil AD CS contact Suspicious DotNet log file created Suspicious Print System Remote Protocol usage by a process Suspicious Udev driver rule execution manipulation Suspicious container orchestration job Suspicious data encryption Suspicious disablement of the Windows Firewall Suspicious module load using direct syscall Suspicious process accessed certificate files Suspicious process modified RC script file Suspicious sshpass command execution Suspicious systemd timer activity Svchost.exe loads a rare unsigned module The Linux system firewall was disabled Uncommon AT task-job creation by user Uncommon NtWriteVirtualMemoryRemote API invocation with a PE header buffer Uncommon PowerShell commands used to create or alter scheduled task parameters Uncommon access to Microsoft Teams credential files Uncommon creation or access operation of sensitive shadow copy Uncommon execution of ODBCConf Uncommon local scheduled task creation via schtasks.exe Uncommon msiexec execution of an arbitrary file from a remote location Uncommon remote monitoring and management tool Uncommon reverse SSH tunnel to external domain/ip Unsigned process creates a scheduled task via file access Unusual AWS credentials creation Unusual AWS user added to group Unusual Azure AD sync module load Unusual CIM repository file access Unusual compressed file password protection Unusual process accessed FTP Client credentials Unusual process accessed a crypto wallet's files Unusual process accessed a messaging app's files Unusual process accessed a web browser history file Usage of homograph characters detected in an email's from header Windows Event Log was cleared using wevtutil.exe Windows event logs were cleared with PowerShell WmiPrvSe.exe Rare Child Command Line Wsmprovhost.exe Rare Child Process
Improved logic of 5 Low Analytics Alerts	Failed Connections Multiple Rare LOLBIN Process Executions by User Multiple discovery commands Multiple discovery commands on a Windows host by the same process Outlook files accessed by an unsigned process
Improved logic of 90 Informational Analytics BIOCs	A LOLBIN was copied to a different location A browser extension was installed or loaded in an uncommon way A cloud identity invoked IAM related persistence operations A compressed file was exfiltrated over SSH A non-browser process accessed a website UI A process connected to a rare cloud resource A process connected to a rare external host A process connected to rare external host A process modified an SSH authorized_keys file A service was disabled Access to Kubernetes configuration file Adding execution privileges An uncommon file added to startup-related Registry keys An uncommon file was created in the startup folder AppleScript executed a shell script AppleScript process executed with a rare command line Browser bookmark files accessed by a rare non-browser process Cloud Unusual Instance Metadata Service (IMDS) access Command execution via wmiexec Commonly abused AutoIT script drops an executable file to disk Creation or modification of the default command executed when opening an application Discovery of host users via WMIC Execution of an uncommon process at an early startup stage Execution of an uncommon process with a local/domain user SID at an early startup stage Globally uncommon IP address connection from a signed process Globally uncommon high entropy process was executed Globally uncommon image load from a signed process Globally uncommon injection from a signed process Globally uncommon process execution from a signed process Indicator blocking Injection into rundll32.exe LOLBAS executable injects into another process LOLBIN created a PSScriptPolicyTest PowerShell script file Linux network share discovery Local account discovery Modification of PAM Msiexec execution of an executable from an uncommon remote location Permission Groups discovery commands Possible DLL Side-Loading Possible Email collection using Outlook RPC Possible binary padding using dd Possible data obfuscation PsExec was executed with a suspicious command line Python HTTP server started Rare LOLBIN Process Execution by User Rare Unix process divided files by size Rare connection to external IP address or host by an application using RMI-IIOP or LDAP protocol Rare process accessed a Keychain file Remote PsExec-like command execution Run downloaded script using pipe Service execution via sc.exe Signed process performed an unpopular DLL injection Signed process performed an unpopular injection Space after filename Suspicious AMSI decode attempt Suspicious Unicode character detected in email Suspicious access to shadow file Suspicious active setup registered Suspicious container runtime connection from within a Kubernetes Pod Suspicious curl user agent Suspicious process executed with a high integrity level Suspicious process execution from tmp folder Suspicious proxy environment variable setting Suspicious usage of Microsoft's Active Directory PowerShell module remote discovery cmdlet Tampering with Internet Explorer Protected Mode configuration Tampering with the Windows User Account Controls (UAC) configuration Uncommon DotNet module load relationship Uncommon GetClipboardData API function invocation of a possible information stealer Uncommon cloud CLI tool usage Uncommon communication to an instant messaging server Uncommon driver loaded Uncommon kernel module load Uncommon macOS shell command execution Uncommon net group or localgroup execution Uncommon network tunnel creation Uncommon remote shell command execution Uncommon service stop operation Uncommon shell command execution Unpopular rsync process execution Unusual ADConnect database file access Unusual DB process spawning a shell Unusual Kubernetes service account file read Unusual access to the AD Sync credential files Unusual access to the Windows Internal Database on an ADFS server Unusual process accessed a macOS notes DB file Unusual process accessed web browser cookies Unusual process accessed web browser credentials Unusual use of a 'SysInternals' tool VM Detection attempt on Linux Web server CGO executed an uncommon process
Improved logic of 7 Informational Analytics Alerts	Massive file activity abnormal to process Multiple discovery commands on a Linux host by the same process Multiple discovery-like commands Port Scan Possible data exfiltration over a USB storage device Suspicious access to cloud credential files Suspicious container reconnaissance activity in a Kubernetes pod
Changed metadata of 3 Low Analytics BIOCs	Email was received from an unknown sender using a disposable domain External email display name impersonation of internal personnel Unusual hostname for the sending mail server in the email headers
Changed metadata of a Low Analytics Alert	Risk indicators detected in email
Changed metadata of 19 Informational Analytics BIOCs	Email Punycode characters in URL(s) Email attachment with a potentially malicious file extension Email attachment with multiple extensions Email attachment(s) with potentially malicious MIME type Email containing a link with an IP address convention was detected Email containing a redirected link Email has a short body or subject and was sent from an external source Email marked as spam and bulk based on Spam Confidence Level and Bulk Complaint Level values Email mimics replies or forwards without an actual ongoing conversation Email suspicious Moniker link detected Email was received from an unknown address using a public provider domain Email was received from an unknown sender using a recognized domain Email with URL shortener detected Rarely seen URL(s) within a well-known domain detected in your organization's email Unpopular URL domain(s) in your organization detected in email Unpopular URL(s) detected in email Unpopular domains detected in email URLs for a recipient Usage of homograph characters detected in an email X-Forefront-Antispam-Report has flagged this email as a potential threat
Changed metadata of an Informational Analytics Alert	Suspicious theme and sentiment in email