Analytics Content Version: 2025.11.05 - Content Update Release Notes - Cortex

Release date: 18 November, 2025

Change type	Changes
Added 2 new Medium Analytics BIOCs	Logging was impaired via external encryption key Suspicious HTTP parameters detected
Added 5 new Low Analytics BIOCs	ClickFix - Powershell executed through the run application Mshta.exe spawns from a browser process PowerShell runs suspicious base64-encoded commands Recurring access to rare domain Uncommon attempt to clear shell history
Added 69 new Informational Analytics BIOCs	A Microsoft Teams application was installed A Microsoft Teams bot was added to a team A cloud identity started a Cloud Shell session A process is masquerading as a common Microsoft product A rare DLL, signed by an uncommon vendor, was hijacked into a Microsoft process A third-party utility was copied to a different location AWS Backup recovery point deletion AWS EBS snapshot deletion AWS S3 object deletion AWS SSM parameters discovery AWS SSM parameters retrieval AWS Secrets Manager Access AWS Secrets Manager discovery AWS Storage Gateway enumeration AWS Storage Gateway fileshare enumeration An identity accessed a cloud storage for the first time An identity accessed cloud storage containing sensitive data Cloud compute volume creation attempt Cloud instance creation attempt Cloud instance deletion attempt Common third-party software name masquerading EBS snapshots were created from an EC2 instance EBS volume attachment attempt EBS volume detachment attempt Executable moved to Windows system folder Execution of masqueraded third-party utility Execution of renamed lolbin External email with a single internal recipient hidden in BCC External user added a link to a Microsoft Teams chat First-seen email from mailbox owner to external recipient's address in the last 30 days GCP sensitive Cloud Run role granted GCP sensitive Deployment Manager role granted GCP sensitive Functions role granted GCP sensitive IAM role granted GCP sensitive Secret Manager role granted GCP sensitive compute role granted GCP sensitive storage role granted IAM inline policy was added to group IAM inline policy was added to role IAM inline policy was added to user IAM instance profile associations were described IAM instance profile was associated with EC2 instance IAM instance profile was created IAM instance profile was replaced for EC2 instance IAM instance profiles were listed IAM policy default version was changed IAM policy version was created IAM policy was attached to group IAM policy was attached to role IAM role-attached managed policies were listed Launch Agent persistency registered or modified Microsoft Teams application setup policy was modified Microsoft Teams external communication policy was modified Microsoft Teams messages were exported from conversation New Teams application published to the organization catalog Outbound email contains file-sharing service link sent to external recipient Outbound email includes an external BCC recipient observed for the first time Potential creation of persistent cloud credentials Potential spoofing of internal domain spotted Serial console access was enabled in AWS account Suspicious DKIM Result Suspicious DMARC result Uncommon attempt at discovering a sensitive file Uncommon attempt at grabbing credentials from a sensitive file Uncommon recurring rare external host access Unsigned DLL Hijack into a Microsoft process Unusual AWS CLI/SDK activity Usage of homograph characters detected in an email attachment(s) name User installed an application in Microsoft Teams via Graph API
Added 7 new Informational Analytics Alerts	A compromised process accessed a rare cloud resource Abnormal connections to a dormant host from a newly seen endpoint External user created a Microsoft Teams conversation with suspicious operations External user started a Microsoft Teams conversation Log enumeration via cloud native logging service User exported multiple messages in Microsoft Teams via Graph API User sent messages in Microsoft Teams to multiple conversations via Graph API
Improved logic of a High Analytics BIOC	Suspicious SaaS API call from a Tor exit node
Improved logic of 7 Medium Analytics BIOCs	A cloud storage object was copied to a foreign cloud account Correlation rule error Error in event forwarding Parsing Rule Error Possible code downloading from a remote host by Regsvr32 Uncommon Service Create/Config Unsigned process injecting into a Windows system binary with no command line
Improved logic of 2 Medium Analytics Alerts	A new machine attempted Kerberos delegation Kerberos User Enumeration
Improved logic of 16 Low Analytics BIOCs	AWS S3 bucket was exposed to public access Abnormal communication with a rare combination of TLS and HTTP User Agent Email attachment with Right-to-Left Override Unicode character Email was received from an unknown sender using a disposable domain LDAP search query from an unpopular and unsigned process Linux system firewall was modified Non-browser access to a pastebin-like site Possible DCSync from a non domain controller Rare RDP session to a remote host Recurring access to rare IP Recurring rare domain access from an unsigned process Suspicious LDAP search query executed Suspicious access of the System Management Container Suspicious modification of the AdminSDHolder's ACL Uncommon SSH session was established Uncommon file access over WebDAV
Improved logic of 20 Low Analytics Alerts	A compromised process accessed a rare external host A user uploaded malware to SharePoint or OneDrive Abnormal RPC traffic to multiple hosts Abnormal SMB activity to multiple hosts Abnormal sensitive RPC traffic to multiple hosts Failed Connections Failed DNS HTTP with suspicious characteristics Impossible traveler - SSO Impossible traveler - VPN Large Upload (Generic) Large Upload (HTTPS) Logs were not collected from a data source for an abnormally long time Multiple Azure AD admin role removals Rare LDAP enumeration Risk indicators detected in email Spam Bot Traffic Suspicious ICMP traffic that resembles smurf attack Suspicious identity downloaded multiple objects from a bucket User added to the SMS Admins local group
Improved logic of 76 Informational Analytics BIOCs	A cloud identity had escalated its permissions A new Azure email domain verification was requested A possible risky login to Azure A process connected to a rare cloud resource A process connected to rare external host A user connected from a new country A user was added to a Windows security group AWS CloudTrail has been stopped AWS CloudTrail modification AWS SES account sending settings modified AWS SSM send command attempt AWS STS temporary credentials were generated Abnormal Communication to a Rare Domain Abnormal Recurring Communications to a Rare Domain Activity in a dormant region of a cloud project An AWS SES identity was deleted An Email address was added to AWS SES An identity started an AWS SSM session An operation was performed by an identity from a domain that was not seen in the organization Cloud compute serial console access Cloud email sending was enabled Cloud email service activity Cloud impersonation attempt by unusual identity type DLP sensitive data exposed to external users Email attachment with a potentially malicious file extension Email attachment with multiple extensions Email attachment(s) with potentially malicious MIME type Email containing a link with an IP address convention was detected Email containing a redirected link Email contains URL delivering high-risk file type Email has a short body or subject and was sent from an external source Email marked as spam and bulk based on Spam Confidence Level and Bulk Complaint Level values Email mimics replies or forwards without an actual ongoing conversation Email was received from an unknown address using a public provider domain Email was received from an unknown sender using a recognized domain Email with URL shortener detected Email with file-sharing link containing auto-download parameter Execution of an uncommon process at an early startup stage First SSO Resource Access in the Organization First SSO access from ASN for user First SSO access from ASN in organization GCP logging sink modification GCP set IAM policy activity IAM role was created Kubernetes nsenter container escape Moniker link detected in URL(s) Possible IPFS traffic was detected Potential DCSync by an unusual user Punycode characters detected in URL(s) Rare AppID usage to a rare destination Rare DLP rule match by user Rare connection to external IP address or host by an application using RMI-IIOP or LDAP protocol Rarely seen URL(s) within a well-known domain detected in your organization's email SaaS suspicious external domain user activity Sending unusual file(s) to an external address Suspicious SPF Result Suspicious SSO authentication Suspicious Unicode character detected in email Suspicious cloud compute instance SSH keys modification attempt Uncommon Linux shell command execution Uncommon SQL like command line Uncommon URL domain(s) in your organization detected in email Unpopular URL(s) detected in email Unpopular domains detected in email URLs for a recipient Unrecognized internal address (AAD mismatch) Unusual AWS systems manager activity Unusual Identity and Access Management (IAM) activity Unusual cloud identity impersonation Unusual hostname for the sending mail server in the email headers Unusual resource modification/creation Unusual use of a 'SysInternals' tool Usage of homograph characters detected in an email Usage of homograph characters detected in an email's from header User accessed SaaS resource via anonymous link User attempted to connect from a suspicious country X-Forefront-Antispam-Report has flagged this email as a potential threat
Improved logic of 36 Informational Analytics Alerts	Abnormal Allocation of compute resources in multiple regions Abnormal RDP connections to multiple hosts Abnormal SMB scanning activity to multiple hosts Allocation of multiple cloud compute resources Cloud email infrastructure enumeration activity Cloud infrastructure enumeration activity Cloud user performed multiple actions that were denied Deletion of multiple cloud resources IP Rotation Pattern in SSO Spray Intense SSO failures Massive file downloads from SaaS service Microsoft Teams enumeration activity Multi region enumeration activity Multiple Okta MFA requests sent to a user Multiple cloud snapshots export Multiple failed logins from a single IP Numerous emails sent by a single sender to multiple internal recipients Okta Reported Threat Detected Okta account reset password attempt Okta account unlock Okta device assignment Port Scan Possible LDAP enumeration by unsigned process Possible Privilege Escalation using Delegated MSA account Potential NTLM Relay Attack Rare access to known advertising domains SSO Password Spray Short-lived Azure AD user account Single account excessively locked out Storage enumeration activity Suspicious reconnaissance using LDAP Uncommon WPAD queries Unusual SSH Activity Unusual attachment volume in outbound emails Upload pattern that resembles Peer to Peer traffic User and Group Enumeration via SAMR
Increased the severity to Low for an Analytics BIOC	Modification of NTLM restrictions in the Registry
Decreased the severity to Low for a BIOC	Scheduled task created with HTTP or FTP reference
Decreased the severity to Informational for 5 Analytics BIOCs	CloudTrail logging deletion External email display name impersonation of internal personnel GCP logging sink deletion Possible DLL Hijack into a Microsoft process Remote usage of an Azure Service Principal token
Decreased the severity to Informational for an Analytics Alert	Suspicious secrets dump activity
Changed metadata of a High Analytics BIOC	Suspicious API call from a Tor exit node
Changed metadata of a High Analytics Alert	Suspicious objects encryption in an AWS bucket
Changed metadata of 2 Medium Analytics BIOCs	Cloud snapshot of a database or storage instance was publicly shared Suspicious usage of EC2 token
Changed metadata of 7 Low Analytics BIOCs	A Backup vault policy was modified AWS data asset shared public An RDS snapshot was exported to an unknown S3 bucket An S3 replication policy to an unknown bucket was created Disable encryption operations GCP data asset shared public Remote usage of an AWS service token
Changed metadata of a Low Analytics Alert	User collected remote shared files in an archive
Changed metadata of 40 Informational Analytics BIOCs	A cloud snapshot of AWS database or storage was modified or shared A cloud storage configuration was modified A process modified an SSH authorized_keys file A user logged in to the AWS console for the first time AWS EC2 instance exported into S3 AWS RDS cluster deletion AWS Transfer Family server created An AWS EFS File-share mount was deleted An AWS EFS file-share was deleted An AWS RDS Global Cluster Deletion An AWS RDS instance was created from a snapshot An AWS S3 bucket configuration was modified An AWS database service master user password was changed An EBS snapshot block was downloaded An identity disabled bucket logging An identity was granted permissions to manage user access to Azure resources An unusual cloud identity was granted permissions to a BigQuery resource Aurora DB cluster stopped Azure Blob Container Access Level Modification Azure Storage Account key generated Azure storage account blob anonymous access is enabled Azure storage account cross-tenant object replication was enabled Azure storage account was publicly shared BigQuery table or query results exfiltrated to a foreign project Cloud access key creation Cloud resource logging was disabled Cloud snapshot created or modified Cloud storage automatic backup disabled Cloud storage delete protection disabled Data encryption was disabled EC2 snapshot attribute has been modified GCP Logging Bucket Deletion GCP Storage Bucket Configuration Modification GCP Storage Bucket Permissions Modification GCP Storage Bucket deletion Member added to a Windows local security group Object versioning was disabled Remote usage of AWS Lambda's role S3 configuration deletion Soft delete of cloud storage configuration was disabled
Changed metadata of 5 Informational Analytics Alerts	A user performed suspiciously massive file activity A user printed an unusual number of files An identity performed a suspicious download of multiple cloud storage objects Possible data exfiltration over a USB storage device Possible internal data exfiltration over a USB storage device
Removed an old Medium Analytics BIOC	PowerShell runs suspicious base64-encoded commands
Removed an old Low BIOC	Mshta.exe spawns from a browser
Removed 2 old Low Analytics BIOCs	Execution of renamed lolbin Possible Microsoft process masquerading
Removed 2 old Informational BIOCs	Host firewall profile discovery using netsh New scheduled task created