Analytics Content Version: 2025.07.09 - Content Update Release Notes - Cortex

Release date: 21 July, 2025

Change type	Changes
Added a new Medium Analytics BIOC	Suspicious dNSHostName attribute change to DC name
Added 5 new Low Analytics BIOCs	A commonly abused process connected to a rare cloud resource A commonly abused process connected to a rare external cloud resource Rare binary connected to a rare cloud resource Rare binary connected to a rare external host Unusual Process Spawned by Nginx in Ingress-Nginx pod
Added 2 new Low Analytics Alerts	Microsoft 365 storage services exfiltration activity Multiple user accounts failed login due to account lockouts
Added 2 new Informational Analytics BIOCs	AppleScript interpreter dynamic library loaded into a process Uncommon sensitive filesystem registry hive access
Added 5 new Informational Analytics Alerts	IP Rotation Pattern in SSO Spray Possible Impossible Travel Pattern - SSO Possible Privilege Escalation using Delegated MSA account SCCM log files enumeration Single account excessively locked out
Improved logic of 2 High Analytics BIOCs	A Successful VPN connection from TOR A successful SSO sign-in from TOR
Improved logic of 4 Medium Analytics BIOCs	A cloud storage object was copied to a foreign cloud account Azure AD PIM alert disabled Cloud snapshot of a database or storage instance was publicly shared Suspicious authentication with Azure Password Hash Sync user
Improved logic of 39 Low Analytics BIOCs	A Backup vault policy was modified A Command Line Interface (CLI) command was executed from an AWS serverless compute service A disabled user attempted to log in to a VPN A user attempted to bypass Okta MFA AURL - An email was sent from a malicious domain AWS S3 bucket was exposed to public access AWS data asset shared public Abnormal communication with a rare combination of TLS and HTTP User Agent An RDS snapshot was exported to an unknown S3 bucket Azure AD PIM role settings change Azure account deletion by a non-standard account Azure domain federation settings modification attempt Cloud Trail logging deletion Email was received from an unknown sender using a disposable domain Executable or Script file written by a web server process External email display name impersonation of internal personnel First Azure AD PowerShell operation for a user GCP data asset shared public LOLBIN process executed with a high integrity level MFA was disabled for an Azure identity Possible webshell file written by a web server process Potential SCCM credential harvesting using WMI detected Rare process created an SSH session to an uncommon cloud resource Rare process executed by an AppleScript Recurring rare domain access from an unsigned process SSO authentication attempt by a honey user SSO authentication by a machine account SSO authentication by a service account Suspicious LDAP search query executed Suspicious Print System Remote Protocol usage by a process Suspicious access of the System Management Container Suspicious process accessed certificate files Unusual CIM repository file access Unusual hostname for the sending mail server in the email headers Unusual process accessed a crypto wallet's files Unusual process accessed a messaging app's files Unusual process accessed a web browser history file VPN login attempt by a honey user VPN login by a service account
Improved logic of 10 Low Analytics Alerts	A user rejected an SSO request from an unusual country Impossible traveler - SSO Impossible traveler - VPN Large Upload (HTTPS) Logs were not collected from a data source for an abnormally long time Multiple Azure AD admin role removals Multiple discovery commands Risk indicators detected in email Suspicious identity downloaded multiple objects from a bucket User added to the SMS Admins local group
Improved logic of 136 Informational Analytics BIOCs	A Kubernetes ConfigMap was created or deleted A Kubernetes Cronjob was created A Kubernetes cluster role binding was created or deleted A Kubernetes cluster was created or deleted A Kubernetes ephemeral container was created A Kubernetes namespace was created or deleted A Kubernetes role binding was created or deleted A Kubernetes secret was created or deleted A Kubernetes service account was created or deleted A Kubernetes service was created or deleted A cloud identity created or modified a security group A cloud identity executed an API call from an unusual country A cloud identity invoked IAM related persistence operations A cloud instance was stopped A cloud snapshot of AWS database or storage was modified or shared A compute-attached identity executed API calls outside the instance's region A container registry was created or deleted A disabled user attempted to authenticate via SSO A new Azure email domain verification was requested A possible risky login to Azure A user accessed Okta's admin application A user connected from a new country A user connected to a VPN from a new country A user created a pfx file for the first time A user logged in at an unusual time via SSO A user logged in at an unusual time via VPN A user modified an Okta network zone A user modified an Okta policy rule AURL - Email contains URL(s) classified as inappropriate AURL - Email contains URL(s) classified as malicious AURL - Email was received from a newly registered domain AURL - Email was sent from a domain classified as inappropriate AURL - Unpopular domain(s) detected in an email's URL(s) AWS Flow Logs deletion AWS SES account sending settings modified AWS Transfer Family server created An AWS SES identity was deleted An Email address was added to AWS SES An identity attached an administrative policy to an IAM user/role An identity was granted permissions to manage user access to Azure resources An unusual archive file creation by a user AppleScript executed a shell script Authentication method added to an Azure account Azure AD PIM elevation request Azure AD account unlock/password reset attempt Azure Temporary Access Pass (TAP) registered to an account Azure account creation by a non-standard account Azure application consent Azure application credentials added Azure device code authentication flow used Azure permission delegation granted Azure service principal assigned app role Azure storage account blob anonymous access is enabled Azure storage account was publicly shared Azure user password reset BitLocker key retrieval Cloud Unusual Instance Metadata Service (IMDS) access Cloud compute instance user data script modification Cloud compute serial console access Cloud email sending was enabled Cloud email service activity Cloud resource logging was disabled Cloud snapshot created or modified Data encryption was disabled Device Registration Policy modification Email Punycode characters in URL(s) Email attachment with a potentially malicious file extension Email attachment with multiple extensions Email attachment(s) with potentially malicious MIME type Email containing a link with an IP address convention was detected Email containing a redirected link Email has a short body or subject and was sent from an external source Email marked as spam and bulk based on Spam Confidence Level and Bulk Complaint Level values Email mimics replies or forwards without an actual ongoing conversation Email suspicious Moniker link detected Email was received from an unknown address using a public provider domain Email was received from an unknown sender using a recognized domain Email with URL shortener detected First SSO Resource Access in the Organization First SSO access from ASN for user First SSO access from ASN in organization First VPN access attempt from a country in organization First VPN access from ASN for user First VPN access from ASN in organization First connection from a country in organization Globally uncommon high entropy process was executed Globally uncommon process execution from a signed process Identity assigned an Azure AD Administrator Role Kubernetes cluster events deletion Kubernetes network policy modification Local user account creation Member added to a Windows local security group Network sniffing detected in Cloud environment Okta API Token Created Okta User Session Impersonation Okta account unlock by admin Okta admin privilege assignment Owner added to Azure application PIM privilege member removal Possible DLL Side-Loading Possible LDAP Enumeration of Microsoft Configuration Manager Potential Okta access limit breach Rare AppID usage to a rare destination Rarely seen URL(s) within a well-known domain detected in your organization's email Removal of an Azure Owner from an Application or Service Principal SSO with abnormal operating system SSO with abnormal user agent SSO with new operating system Successful unusual guest user invitation Suspicious Azure AD interactive sign-in using PowerShell Suspicious NTLM authentication with machine account Suspicious SSO access from ASN Suspicious SSO authentication Suspicious Unicode character detected in email Suspicious domain user account creation Uncommon cloud CLI tool usage Uncommon net group or localgroup execution Unpopular URL domain(s) in your organization detected in email Unpopular URL(s) detected in email Unpopular domains detected in email URLs for a recipient Unusual ADConnect database file access Unusual Conditional Access operation for an identity Unusual Identity and Access Management (IAM) activity Unusual access to the AD Sync credential files Unusual process accessed a macOS notes DB file Unusual process accessed web browser cookies Unusual process accessed web browser credentials Unusual resource modification by newly seen IAM user Usage of homograph characters detected in an email User added a new device to Okta Verify instance User attempted to connect from a suspicious country VPN access with an abnormal operating system VPN login by a dormant user VPN login with a machine account Web server CGO executed an uncommon process X-Forefront-Antispam-Report has flagged this email as a potential threat
Improved logic of 34 Informational Analytics Alerts	A user accessed an abnormal number of files on a remote shared folder A user accessed an abnormal number of remote shared folders A user accessed multiple time-consuming websites A user accessed multiple unusual resources via SSO A user performed suspiciously massive file activity A user printed an unusual number of files A user took numerous screenshots Abnormal File Activity in SCCMContentLib Shared Folder by user An identity performed a suspicious download of multiple cloud storage objects Cloud email infrastructure enumeration activity Cloud infrastructure enumeration activity Deletion of multiple cloud resources External SaaS file-sharing activity IAM Enumeration sequence Increase in Job-Related Site Visits Intense SSO failures Kubernetes enumeration activity Massive file compression by user Massive file downloads from SaaS service Massive upload to SaaS service Massive upload to a rare storage or mail domain Microsoft Configuration Manager device registration and policy request Multiple Okta MFA requests sent to a user NTLM Relay Okta account reset password attempt Okta account unlock Possible data exfiltration over a USB storage device Possible internal data exfiltration over a USB storage device Potential NTLM Relay Attack SSO Brute Force SSO Password Spray Short-lived Azure AD user account Storage enumeration activity VPN login Brute-Force attempt
Decreased the severity to Low for an Analytics BIOC	Unprivileged process opened a registry hive
Decreased the severity to Informational for an Analytics BIOC	Usage of homograph characters detected in an email's from header
Changed metadata of 2 Medium Analytics BIOCs	Phantom DLL Loading Windows LOLBIN executable connected to a rare external host
Changed metadata of 7 Low Analytics BIOCs	An S3 replication policy to an unknown bucket was created Possible DLL Hijack into a Microsoft process Possible DLL Search Order Hijacking Rare communication over email ports to external email server by unsigned process Rare process created an SSH session to an uncommon external host Scripting engine connected to a rare external host Uncommon VNC server communication
Changed metadata of 8 Informational Analytics BIOCs	A process connected to a rare cloud resource A process connected to rare external host Globally uncommon image load from a signed process Possible authentication coercion Privileged certificate request via certificate template Suspicious MFA request reported by user in Entra ID Uncommon service stop operation Unusual Kubernetes service account file read