Analytics Content Version: 2025.10.22 - Content Update Release Notes - Cortex

Release date: 12 November, 2025

Change type	Changes
Added a new Low Analytics BIOC	Uncommon attempt to clear shell history
Added 20 new Informational Analytics BIOCs	AWS Storage Gateway enumeration AWS Storage Gateway fileshare enumeration An identity accessed a cloud storage for the first time An identity accessed cloud storage containing sensitive data First-seen email from mailbox owner to external recipient's address in the last 30 days GCP sensitive Cloud Run role granted GCP sensitive Deployment Manager role granted GCP sensitive Functions role granted GCP sensitive IAM role granted GCP sensitive Secret Manager role granted GCP sensitive compute role granted GCP sensitive storage role granted IAM inline policy was added to group IAM inline policy was added to role IAM inline policy was added to user IAM policy default version was changed IAM policy version was created IAM policy was attached to group Serial console access was enabled in AWS account Unsigned DLL Hijack into a Microsoft process
Added a new Informational Analytics Alert	Log enumeration via cloud native logging service
Improved logic of a Low Analytics BIOC	AWS S3 bucket was exposed to public access
Improved logic of 3 Low Analytics Alerts	A user uploaded malware to SharePoint or OneDrive Rare LDAP enumeration Risk indicators detected in email
Improved logic of 13 Informational Analytics BIOCs	An operation was performed by an identity from a domain that was not seen in the organization Email containing a link with an IP address convention was detected Email containing a redirected link Email with URL shortener detected GCP set IAM policy activity Moniker link detected in URL(s) Punycode characters detected in URL(s) Rarely seen URL(s) within a well-known domain detected in your organization's email Suspicious Unicode character detected in email Uncommon URL domain(s) in your organization detected in email Unpopular URL(s) detected in email Unpopular domains detected in email URLs for a recipient Unusual use of a 'SysInternals' tool
Improved logic of an Informational Analytics Alert	Microsoft Teams enumeration activity
Decreased the severity to Low for a BIOC	Scheduled task created with HTTP or FTP reference
Decreased the severity to Informational for an Analytics BIOC	Possible DLL Hijack into a Microsoft process
Changed metadata of an Informational Analytics BIOC	Member added to a Windows local security group
Removed 2 old Informational BIOCs	Host firewall profile discovery using netsh New scheduled task created