Analytics Content Version: 2025.08.20 - Content Update Release Notes - Cortex

Release date: 8 September, 2025

Change type	Changes
Added 2 new Low Analytics BIOCs	Email attachment with Right-to-Left Override Unicode character Uncommon sensitive registry hive dump
Added a new Low Analytics Alert	A compromised process accessed a rare external host
Added 9 new Informational Analytics BIOCs	An EBS snapshot block was downloaded An unknown account was invited to the AWS organization An unusual cloud identity was granted permissions to a BigQuery resource BigQuery table or query results exfiltrated to a foreign project Email contains URL delivering high-risk file type Email with file-sharing link containing auto-download parameter Sending unusual file(s) to an external address Suspicious SPF Result Unusual Kubernetes secret access
Added 2 new Informational Analytics Alerts	Numerous emails sent by a single sender to multiple internal recipients Unusual attachment volume in outbound emails
Improved logic of 7 High Analytics BIOCs	Copy a process memory file Memory dumping with comsvcs.dll Mimikatz command-line arguments Suspicious API call from a Tor exit node Suspicious usage of File Server Remote VSS Protocol (FSRVP) Uncommon remote scheduled task creation Unicode RTL Override Character
Improved logic of a High Analytics Alert	Suspicious objects encryption in an AWS bucket
Improved logic of 41 Medium Analytics BIOCs	A Kubernetes API operation was successfully invoked by an anonymous user A TCP stream was created directly in a shell A cloud storage object was copied to a foreign cloud account A process was executed with a command line obfuscated by Unicode character substitution Autorun.inf created in root C drive Cloud snapshot of a database or storage instance was publicly shared Commonly abused AutoIT script connects to an external domain Encoded information using Windows certificate management tool Executable created to disk by lsass.exe Execution of the Hydra Linux password brute-force tool Fodhelper.exe UAC bypass Indirect command execution using the Program Compatibility Assistant Interactive at.exe privilege escalation method Kerberos Traffic from Non-Standard Process Kubernetes vulnerability scanning tool usage LSASS dump file written to disk Microsoft Office Process Spawning a Suspicious One-Liner Penetration testing tool activity Phantom DLL Loading Possible Persistence via group policy Registry keys Possible RDP session hijacking using tscon.exe Possible code downloading from a remote host by Regsvr32 Possible collection of screen captures with Windows Problem Steps Recorder Possible malicious .NET compilation started by a commonly abused process PowerShell runs suspicious base64-encoded commands PowerShell suspicious flags Procdump executed from an atypical directory Remote WMI process execution Rundll32.exe running with no command-line arguments Rundll32.exe spawns conhost.exe Suspicious .NET process loads an MSBuild DLL Suspicious PowerSploit's recon module (PowerView) net function was executed Suspicious PowerSploit's recon module (PowerView) used to search for exposed hosts Suspicious certutil command line Suspicious heavy allocation of compute resources - possible mining activity Suspicious usage of EC2 token Uncommon DLL-sideloading from a logical CD-ROM (ISO) device Uncommon SetWindowsHookEx API invocation of a possible keylogger Unsigned process injecting into a Windows system binary with no command line Unusual process access to ld.so.preload file Windows LOLBIN executable connected to a rare external host
Improved logic of 135 Low Analytics BIOCs	A Backup vault policy was modified A Command Line Interface (CLI) command was executed from an AWS serverless compute service A cloud function was created with an unusual runtime A commonly abused process connected to a rare cloud resource A commonly abused process connected to a rare external host A process queried the ADFS database decryption key via LDAP A rare file path was added to the AppInit_DLLs registry value A remote service was created via RPC over SMB A suspicious direct syscall was executed A suspicious process enrolled for a certificate AWS Guard-Duty detector deletion AWS S3 bucket was exposed to public access AWS data asset shared public AWS web ACL deletion An Azure Firewall policy deletion An RDS snapshot was exported to an unknown S3 bucket An uncommon service was started An unpopular process accessed the microphone on the host Attempt to execute a command on a remote host using PsExec.exe Azure Event Hub Deletion Azure Network Watcher Deletion Azure account deletion by a non-standard account Billing admin role was removed Cached credentials discovery with cmdkey Change of sudo caching configuration Cloud Trail logging deletion Compressing data using python Conhost.exe spawned a suspicious cmd process Copy a user's GnuPG directory with rsync Disable encryption operations Download a script using the python requests module Elevation to SYSTEM via services Email was received from an unknown sender using a disposable domain Executable or Script file written by a web server process Execution of an uncommon process at an early startup stage by Windows system binary Execution of an uncommon process with a local/domain user SID at an early startup stage by Windows system binary Execution of dllhost.exe with an empty command line Execution of renamed lolbin External email display name impersonation of internal personnel Extracting credentials from Unix files First Azure AD PowerShell operation for a user GCP Logging Sink Deletion GCP data asset shared public Globally uncommon root domain from a signed process Globally uncommon root-domain port combination from a signed process Image file execution options (IFEO) registry key set Installation of a new System-V service Keylogging using system commands Known service display name with uncommon image-path Known service name with an uncommon image-path LOLBIN process executed with a high integrity level Linux system firewall was modified MFA was disabled for an Azure identity Masquerading as a default local account Masquerading as the Linux crond process Microsoft Office adds a value to autostart Registry key Microsoft Office injects code into a process Microsoft Office process spawns a commonly abused process NTDS.dit file written by an uncommon executable New FTP Server New addition to Windows Defender exclusion list Office process accessed an unusual .LNK file Office process spawned with suspicious command-line arguments Possible DLL Hijack into a Microsoft process Possible DLL Search Order Hijacking Possible Microsoft process masquerading Possible network sniffing attempt via tcpdump or tshark Possible webshell file written by a web server process Potential SCCM credential harvesting using WMI detected RDP connections enabled remotely via Registry Rare binary connected to a rare cloud resource Rare binary connected to a rare external host Rare process created an SSH session to an uncommon cloud resource Rare process created an SSH session to an uncommon external host Rare process executed by an AppleScript Rare process with VNC server capabilities started Rare scheduled task created Rare service DLL was added to the registry Reading bash command history file Recurring rare domain access from an unsigned process Remote DCOM command execution Remote command execution via wmic.exe Remote service start from an uncommon source Remote usage of an AWS service token Rundll32.exe executes a rare unsigned module SUID/GUID permission discovery Scheduled Task hidden by registry modification Screensaver process executed from Users or temporary folder Scripting engine connected to a rare external host Sensitive browser credential files accessed by a rare non browser process Setuid and Setgid file bit manipulation Stored credentials exported using credwiz.exe Suspicious Certutil AD CS contact Suspicious DotNet log file created Suspicious Print System Remote Protocol usage by a process Suspicious Udev driver rule execution manipulation Suspicious container orchestration job Suspicious data encryption Suspicious disablement of the Windows Firewall Suspicious module load using direct syscall Suspicious process accessed certificate files Suspicious process modified RC script file Suspicious sshpass command execution Suspicious systemd timer activity Svchost.exe loads a rare unsigned module The Linux system firewall was disabled Uncommon AT task-job creation by user Uncommon NtWriteVirtualMemoryRemote API invocation with a PE header buffer Uncommon PowerShell commands used to create or alter scheduled task parameters Uncommon access to Microsoft Teams credential files Uncommon creation or access operation of sensitive shadow copy Uncommon execution of ODBCConf Uncommon local scheduled task creation via schtasks.exe Uncommon msiexec execution of an arbitrary file from a remote location Uncommon remote monitoring and management tool Uncommon reverse SSH tunnel to external domain/ip Unprivileged process opened a registry hive Unsigned and unpopular process performed a DLL injection Unsigned and unpopular process performed an injection Unsigned process creates a scheduled task via file access Unusual AWS credentials creation Unusual AWS user added to group Unusual Azure AD sync module load Unusual CIM repository file access Unusual Process Spawned by Nginx in Ingress-Nginx pod Unusual compressed file password protection Unusual cross projects activity Unusual process accessed FTP Client credentials Unusual process accessed a crypto wallet's files Unusual process accessed a messaging app's files Unusual process accessed a web browser history file Windows Event Log was cleared using wevtutil.exe Windows event logs were cleared with PowerShell WmiPrvSe.exe Rare Child Command Line Wsmprovhost.exe Rare Child Process
Improved logic of 9 Low Analytics Alerts	An identity dumped multiple secrets from a project Failed Connections Large Upload (HTTPS) Multiple Rare LOLBIN Process Executions by User Multiple discovery commands Multiple discovery commands on a Windows host by the same process Outlook files accessed by an unsigned process Risk indicators detected in email Suspicious identity downloaded multiple objects from a bucket
Improved logic of 281 Informational Analytics BIOCs	A Kubernetes ConfigMap was created or deleted A Kubernetes Cronjob was created A Kubernetes cluster role binding was created or deleted A Kubernetes cluster was created or deleted A Kubernetes ephemeral container was created A Kubernetes namespace was created or deleted A Kubernetes role binding was created or deleted A Kubernetes secret was created or deleted A Kubernetes service account was created or deleted A Kubernetes service was created or deleted A LOLBIN was copied to a different location A New Server was Added to an Azure Active Directory Hybrid Health ADFS Environment A Service Principal was created in Azure A Service Principal was removed from Azure A browser extension was installed or loaded in an uncommon way A cloud identity created or modified a security group A cloud identity executed an API call from an unusual country A cloud identity had escalated its permissions A cloud identity invoked IAM related persistence operations A cloud instance was stopped A cloud snapshot of AWS database or storage was modified or shared A cloud storage configuration was modified A compressed file was exfiltrated over SSH A compute-attached identity executed API calls outside the instance's region A container registry was created or deleted A new Azure email domain verification was requested A non-browser process accessed a website UI A process connected to a rare cloud resource A process connected to a rare external host A process connected to rare external host A process modified an SSH authorized_keys file A service was disabled A user logged in to the AWS console for the first time AWS Cloud Trail log trail modification AWS CloudWatch log group deletion AWS CloudWatch log stream deletion AWS Config Recorder stopped AWS EC2 instance exported into S3 AWS Flow Logs deletion AWS IAM resource group deletion AWS RDS cluster deletion AWS Root account activity AWS SES account sending settings modified AWS STS temporary credentials were generated AWS SecurityHub findings were modified AWS Transfer Family server created AWS config resource deletion AWS network ACL rule creation AWS network ACL rule deletion AWS user creation Abnormal Communication to a Rare Domain Access to Kubernetes configuration file Activity in a dormant region of a cloud project Adding execution privileges An AWS EFS File-share mount was deleted An AWS EFS file-share was deleted An AWS EKS cluster was created or deleted An AWS GuardDuty IP set was created An AWS Lambda Function was created An AWS Lambda function was modified An AWS RDS Global Cluster Deletion An AWS RDS instance was created from a snapshot An AWS Route 53 domain was transferred to another AWS account An AWS S3 bucket configuration was modified An AWS SAML provider was modified An AWS SES identity was deleted An AWS database service master user password was changed An Azure DNS Zone was modified An Azure Firewall rule collection group was modified or deleted An Azure Firewall was modified An Azure Key Vault key was modified An Azure Key Vault was modified An Azure Kubernetes Cluster was created or deleted An Azure Kubernetes Role or Cluster-Role was modified An Azure Kubernetes Role-Binding or Cluster-Role-Binding was modified or deleted An Azure Kubernetes Service Account was modified or deleted An Azure Network Security Group was modified An Azure Point-to-Site VPN was modified An Azure Suppression Rule was created An Azure VPN Connection was modified An Azure firewall rule group was modified An Azure virtual network Device was modified An Azure virtual network was modified An Email address was added to AWS SES An IAM group was created An identity accessed Azure Kubernetes Secrets An identity attached an administrative policy to an IAM user or role An identity created or updated password for an IAM user An identity disabled bucket logging An identity started an AWS SSM session An identity was granted permissions to manage user access to Azure resources An operation was performed by an identity from a domain that was not seen in the organization An uncommon file added to startup-related Registry keys An uncommon file was created in the startup folder AppleScript executed a shell script AppleScript interpreter dynamic library loaded into a process AppleScript process executed with a rare command line Aurora DB cluster stopped Authentication method added to an Azure account Azure AD account unlock/password reset attempt Azure Automation Account Creation Azure Automation Runbook Creation/Modification Azure Automation Runbook Deletion Azure Automation Webhook creation Azure Blob Container Access Level Modification Azure Event Hub Authorization rule creation/modification Azure Key Vault Secrets were modified Azure Key Vault modification Azure Kubernetes events were deleted Azure Resource Group Deletion Azure Storage Account key generated Azure account creation by a non-standard account Azure application removed Azure device code authentication flow used Azure diagnostic configuration deletion Azure permission delegation granted Azure storage account blob anonymous access is enabled Azure storage account was publicly shared Azure virtual machine commands execution Browser bookmark files accessed by a rare non-browser process Cloud Trail Logging has been stopped/suspended Cloud Unusual Instance Metadata Service (IMDS) access Cloud Watch alarm deletion Cloud access key creation Cloud compute instance user data script modification Cloud compute serial console access Cloud email sending was enabled Cloud email service activity Cloud identity reached a throttling API rate Cloud impersonation attempt by unusual identity type Cloud resource logging was disabled Cloud snapshot created or modified Command execution via wmiexec Commonly abused AutoIT script drops an executable file to disk Creation or modification of the default command executed when opening an application Data encryption was disabled Discovery of host users via WMIC EC2 snapshot attribute has been modified Email Punycode characters in URL(s) Email attachment with a potentially malicious file extension Email attachment with multiple extensions Email attachment(s) with potentially malicious MIME type Email containing a link with an IP address convention was detected Email containing a redirected link Email has a short body or subject and was sent from an external source Email marked as spam and bulk based on Spam Confidence Level and Bulk Complaint Level values Email mimics replies or forwards without an actual ongoing conversation Email suspicious Moniker link detected Email was received from an unknown address using a public provider domain Email was received from an unknown sender using a recognized domain Email with URL shortener detected Execution of an uncommon process at an early startup stage Execution of an uncommon process with a local/domain user SID at an early startup stage GCP Firewall Rule Modification GCP Firewall Rule creation GCP IAM Role Deletion GCP IAM Service Account Key Deletion GCP Logging Bucket Deletion GCP Logging Sink Modification GCP Pub/Sub Subscription Deletion GCP Pub/Sub Topic Deletion GCP Service Account Disable GCP Service Account creation GCP Service Account deletion GCP Service Account key creation GCP Storage Bucket Configuration Modification GCP Storage Bucket Permissions Modification GCP Storage Bucket deletion GCP VPC Firewall Rule Deletion GCP Virtual Private Cloud (VPC) Network Deletion GCP Virtual Private Network Route Creation GCP Virtual Private Network Route Deletion Globally uncommon IP address connection from a signed process Globally uncommon high entropy process was executed Globally uncommon image load from a signed process Globally uncommon injection from a signed process Globally uncommon process execution from a signed process Granting Access to an Account IAM User added to an IAM group IAM role trust policy modification IAM role was created Identity assigned an Azure AD Administrator Role Indicator blocking Injection into rundll32.exe Kubernetes cluster events deletion Kubernetes network policy modification Kubernetes secret enumeration activity LOLBAS executable injects into another process LOLBIN created a PSScriptPolicyTest PowerShell script file Linux network share discovery Local account discovery MFA device was removed/deactivated from an IAM user Modification of PAM Modification or Deletion of an Azure Application Gateway Detected Msiexec execution of an executable from an uncommon remote location Network sniffing detected in Cloud environment PIM privilege member removal Penetration testing tool activity attempt Penetration testing tool attempt Permission Groups discovery commands Possible DLL Side-Loading Possible Email collection using Outlook RPC Possible binary padding using dd Possible data obfuscation PsExec was executed with a suspicious command line Python HTTP server started Rare LOLBIN Process Execution by User Rare Unix process divided files by size Rare connection to external IP address or host by an application using RMI-IIOP or LDAP protocol Rare process accessed a Keychain file Rare signature signed executable executed in the network Rarely seen URL(s) within a well-known domain detected in your organization's email Remote PsExec-like command execution Remote code execution into Kubernetes Pod Remote usage of AWS Lambda's role Remote usage of an App engine Service Account token Removal of an Azure Owner from an Application or Service Principal Run downloaded script using pipe S3 configuration deletion SSO with abnormal user agent Service execution via sc.exe Signed process performed an unpopular DLL injection Signed process performed an unpopular injection Soft delete of cloud storage configuration was disabled Space after filename Suspicious AMSI decode attempt Suspicious Unicode character detected in email Suspicious access to shadow file Suspicious active setup registered Suspicious cloud compute instance SSH keys modification attempt Suspicious container runtime connection from within a Kubernetes Pod Suspicious curl user agent Suspicious process executed with a high integrity level Suspicious process execution from tmp folder Suspicious proxy environment variable setting Suspicious usage of Microsoft's Active Directory PowerShell module remote discovery cmdlet Tampering with Internet Explorer Protected Mode configuration Tampering with the Windows User Account Controls (UAC) configuration Uncommon DotNet module load relationship Uncommon GetClipboardData API function invocation of a possible information stealer Uncommon Linux remote shell command execution Uncommon Linux shell command execution Uncommon SQL like command line Uncommon access to cloud platforms' sensitive files by a scripting engine Uncommon cloud CLI tool usage Uncommon communication to an instant messaging server Uncommon kernel module load Uncommon macOS shell command execution Uncommon net group command execution Uncommon net localgroup command execution Uncommon network tunnel creation Uncommon sensitive filesystem registry hive access Uncommon service stop operation Unpopular URL domain(s) in your organization detected in email Unpopular URL(s) detected in email Unpopular domains detected in email URLs for a recipient Unpopular rsync process execution Unrecognized internal address (AAD mismatch) Unusual ADConnect database file access Unusual AWS systems manager activity Unusual DB process spawning a shell Unusual IAM enumeration activity by a non-user Identity Unusual Identity and Access Management (IAM) activity Unusual Kubernetes service account file read Unusual access to the AD Sync credential files Unusual access to the Windows Internal Database on an ADFS server Unusual certificate management activity Unusual cloud identity impersonation Unusual key management activity Unusual process accessed a macOS notes DB file Unusual process accessed web browser cookies Unusual process accessed web browser credentials Unusual resource modification by newly seen IAM user Unusual resource modification/creation Unusual secret management activity Unusual use of a 'SysInternals' tool Usage of homograph characters detected in an email Usage of homograph characters detected in an email's from header VM Detection attempt on Linux Web server CGO executed an uncommon process X-Forefront-Antispam-Report has flagged this email as a potential threat
Improved logic of 21 Informational Analytics Alerts	Abnormal Allocation of compute resources in multiple regions An identity performed a suspicious download of multiple cloud storage objects Cloud email infrastructure enumeration activity Cloud infrastructure enumeration activity Cloud user performed multiple actions that were denied Deletion of multiple cloud resources IAM Enumeration sequence Internal Login Password Spray Kubernetes enumeration activity Massive file activity abnormal to process Multi region enumeration activity Multiple cloud snapshots export Multiple discovery commands on a Linux host by the same process Multiple discovery-like commands Multiple failed logins from a single IP Port Scan Possible data exfiltration over a USB storage device Storage enumeration activity Suspicious access to cloud credential files Suspicious container reconnaissance activity in a Kubernetes pod Suspicious theme and sentiment in email
Increased the severity to Low for an Analytics BIOC	Uncommon driver loaded
Decreased the severity to Informational for 2 Analytics BIOCs	Modification of NTLM restrictions in the Registry Unusual hostname for the sending mail server in the email headers
Changed metadata of a High Analytics BIOC	Collection error
Changed metadata of 3 Medium Analytics BIOCs	Correlation rule error Error in event forwarding Parsing Rule Error
Changed metadata of a Low Analytics BIOC	Okta FastPass reported phishing attack suspected
Changed metadata of a Low Analytics Alert	Logs were not collected from a data source for an abnormally long time
Changed metadata of an Informational Analytics BIOC	A possible risky login to Azure
Changed metadata of an Informational Analytics Alert	A user accessed multiple unusual resources via SSO
Removed an old Medium Analytics BIOC	Vulnerable driver loaded
Temporarily removed a Informational Analytics Alert for improvement	SSH brute force attempt