Analytics Content Version: 2025.10.08 - Content Update Release Notes - Cortex

Release date: 27 October, 2025

Change type	Changes
Added 2 new Medium Analytics BIOCs	Logging was impaired via external encryption key Suspicious HTTP parameters detected
Added 20 new Informational Analytics BIOCs	A process is masquerading as a common Microsoft product Common third-party software name masquerading EBS snapshots were created from an EC2 instance Executable moved to Windows system folder External email with a single internal recipient hidden in BCC IAM instance profile associations were described IAM instance profile was associated with EC2 instance IAM instance profile was created IAM instance profile was replaced for EC2 instance IAM instance profiles were listed IAM policy was attached to role IAM role-attached managed policies were listed Launch Agent persistency registered or modified Outbound email contains file-sharing service link sent to external recipient Outbound email includes an external BCC recipient observed for the first time Potential spoofing of internal domain spotted Suspicious DKIM Result Suspicious DMARC result Uncommon access to a sensitive file Usage of homograph characters detected in an email attachment(s) name
Added 2 new Informational Analytics Alerts	A compromised process accessed a rare cloud resource Abnormal connections to a dormant host from a newly seen endpoint
Improved logic of 3 Medium Analytics BIOCs	Possible code downloading from a remote host by Regsvr32 Uncommon Service Create/Config Unsigned process injecting into a Windows system binary with no command line
Improved logic of a Medium Analytics Alert	Kerberos User Enumeration
Improved logic of 7 Low Analytics BIOCs	Email attachment with Right-to-Left Override Unicode character Email was received from an unknown sender using a disposable domain LDAP search query from an unpopular and unsigned process Non-browser access to a pastebin-like site Possible DCSync from a non domain controller Recurring rare domain access from an unsigned process Suspicious LDAP search query executed
Improved logic of 5 Low Analytics Alerts	Large Upload (Generic) Large Upload (HTTPS) Logs were not collected from a data source for an abnormally long time Rare LDAP enumeration Risk indicators detected in email
Improved logic of 51 Informational Analytics BIOCs	A new Azure email domain verification was requested A process connected to a rare cloud resource AWS CloudTrail has been stopped AWS CloudTrail modification AWS SES account sending settings modified AWS SSM send command attempt Abnormal Recurring Communications to a Rare Domain An AWS SES identity was deleted An Email address was added to AWS SES An identity started an AWS SSM session Cloud compute serial console access Cloud email sending was enabled Cloud email service activity Email attachment with a potentially malicious file extension Email attachment with multiple extensions Email attachment(s) with potentially malicious MIME type Email containing a link with an IP address convention was detected Email containing a redirected link Email contains URL delivering high-risk file type Email has a short body or subject and was sent from an external source Email marked as spam and bulk based on Spam Confidence Level and Bulk Complaint Level values Email mimics replies or forwards without an actual ongoing conversation Email was received from an unknown address using a public provider domain Email was received from an unknown sender using a recognized domain Email with URL shortener detected Email with file-sharing link containing auto-download parameter Execution of an uncommon process at an early startup stage GCP logging sink modification IAM role was created Kubernetes nsenter container escape Moniker link detected in URL(s) Punycode characters detected in URL(s) Rare connection to external IP address or host by an application using RMI-IIOP or LDAP protocol Rarely seen URL(s) within a well-known domain detected in your organization's email Sending unusual file(s) to an external address Suspicious SPF Result Suspicious SSO authentication Suspicious Unicode character detected in email Suspicious cloud compute instance SSH keys modification attempt Uncommon Linux shell command execution Uncommon SQL like command line Unpopular URL domain(s) in your organization detected in email Unpopular URL(s) detected in email Unpopular domains detected in email URLs for a recipient Unrecognized internal address (AAD mismatch) Unusual AWS systems manager activity Unusual hostname for the sending mail server in the email headers Usage of homograph characters detected in an email Usage of homograph characters detected in an email's from header User attempted to connect from a suspicious country X-Forefront-Antispam-Report has flagged this email as a potential threat
Improved logic of 10 Informational Analytics Alerts	Abnormal Allocation of compute resources in multiple regions Cloud email infrastructure enumeration activity IP Rotation Pattern in SSO Spray Intense SSO failures Numerous emails sent by a single sender to multiple internal recipients Port Scan Possible LDAP enumeration by unsigned process SSO Password Spray Suspicious reconnaissance using LDAP Unusual attachment volume in outbound emails
Decreased the severity to Informational for 3 Analytics BIOCs	CloudTrail logging deletion External email display name impersonation of internal personnel GCP logging sink deletion
Changed metadata of a High Analytics BIOC	Suspicious API call from a Tor exit node
Changed metadata of a High Analytics Alert	Suspicious objects encryption in an AWS bucket
Changed metadata of 3 Medium Analytics BIOCs	A cloud storage object was copied to a foreign cloud account Cloud snapshot of a database or storage instance was publicly shared Suspicious usage of EC2 token
Changed metadata of 8 Low Analytics BIOCs	A Backup vault policy was modified AWS S3 bucket was exposed to public access AWS data asset shared public An RDS snapshot was exported to an unknown S3 bucket An S3 replication policy to an unknown bucket was created Disable encryption operations GCP data asset shared public Remote usage of an AWS service token
Changed metadata of a Low Analytics Alert	Suspicious identity downloaded multiple objects from a bucket
Changed metadata of 45 Informational Analytics BIOCs	A cloud identity had escalated its permissions A cloud snapshot of AWS database or storage was modified or shared A cloud storage configuration was modified A process modified an SSH authorized_keys file A third-party utility was copied to a different location A user logged in to the AWS console for the first time AWS EC2 instance exported into S3 AWS RDS cluster deletion AWS STS temporary credentials were generated AWS Transfer Family server created An AWS EFS File-share mount was deleted An AWS EFS file-share was deleted An AWS RDS Global Cluster Deletion An AWS RDS instance was created from a snapshot An AWS S3 bucket configuration was modified An AWS database service master user password was changed An EBS snapshot block was downloaded An identity disabled bucket logging An identity was granted permissions to manage user access to Azure resources An unusual cloud identity was granted permissions to a BigQuery resource Aurora DB cluster stopped Azure Blob Container Access Level Modification Azure Storage Account key generated Azure storage account blob anonymous access is enabled Azure storage account cross-tenant object replication was enabled Azure storage account was publicly shared BigQuery table or query results exfiltrated to a foreign project Cloud resource logging was disabled Cloud snapshot created or modified Cloud storage automatic backup disabled Cloud storage delete protection disabled Data encryption was disabled EBS volume attachment attempt EC2 snapshot attribute has been modified Execution of masqueraded third-party utility Execution of renamed lolbin GCP Logging Bucket Deletion GCP Storage Bucket Configuration Modification GCP Storage Bucket Permissions Modification GCP Storage Bucket deletion Object versioning was disabled Remote usage of AWS Lambda's role S3 configuration deletion Soft delete of cloud storage configuration was disabled Unusual Identity and Access Management (IAM) activity
Changed metadata of 5 Informational Analytics Alerts	An identity performed a suspicious download of multiple cloud storage objects Deletion of multiple cloud resources Multiple cloud snapshots export Multiple failed logins from a single IP Storage enumeration activity
Removed an old Low Analytics BIOC	Possible Microsoft process masquerading