Release date: 1 December, 2025Change typeChangesAdded a new Low Analytics AlertSuspicious activity indicating a potential abuse of a cloud-native email serviceAdded 9 new Informational Analytics BIOCsAn identity accessed a backup cloud storageAn unusual read activity of cloud objectBucket's block public access setting turned offBucket's object ownership controls were modifiedEC2 instance Amazon machine image was createdForeign account was granted permissions to S3 bucket via resource-based policyGCP administrative role granted to a cloud identityLocal group enumeration via RPCUncommon Launch Daemon persistency was registered or modifiedAdded a new Informational Analytics AlertAn identity initiated a download of multiple cloud objectsImproved logic of a High Analytics BIOCSuspicious API call from a Tor exit nodeImproved logic of a High Analytics AlertSuspicious objects encryption in an AWS bucketImproved logic of 10 Medium Analytics BIOCsA Kubernetes API operation was successfully invoked by an anonymous userA Kubernetes dashboard service account was used outside the clusterA cloud storage object was copied to a foreign cloud accountAzure AD PIM alert disabledCloud snapshot of a database or storage instance was publicly sharedKubernetes vulnerability scanning tool usageLogging was impaired via external encryption keyPenetration testing tool activitySuspicious heavy allocation of compute resources - possible mining activitySuspicious usage of EC2 tokenImproved logic of 36 Low Analytics BIOCsA Backup vault policy was modifiedA Command Line Interface (CLI) command was executed from a GCP serverless compute serviceA Command Line Interface (CLI) command was executed from an AWS serverless compute serviceA cloud function was created with an unusual runtimeAWS Guard-Duty detector deletionAWS S3 bucket was exposed to public accessAWS data asset shared publicAWS web ACL deletionAn Azure Firewall policy deletionAn RDS snapshot was exported to an unknown S3 bucketAn S3 replication policy to an unknown bucket was createdAzure AD PIM role settings changeAzure Event Hub DeletionAzure Network Watcher DeletionAzure account deletion by a non-standard accountAzure domain federation settings modification attemptBilling admin role was removedConditional Access policy removedDisable encryption operationsEmail attachment with Right-to-Left Override Unicode characterEmail was received from an unknown sender using a disposable domainExecution of an uncommon process at an early startup stage by Windows system binaryExecution of an uncommon process with a local/domain user SID at an early startup stage by Windows system binaryFirst Azure AD PowerShell operation for a userGCP data asset shared publicKubernetes pod creation from unknown container image registryMFA was disabled for an Azure identityRare process executed by an AppleScriptRemote usage of an AWS service tokenRemote usage of an Azure Managed Identity tokenUncommon local scheduled task creation via schtasks.exeUnsigned process execution by scheduled taskUnusual cross projects activityUnusual process accessed a crypto wallet's filesUnusual process accessed a messaging app's filesUnusual process accessed a web browser history fileImproved logic of 6 Low Analytics AlertsLarge Upload (HTTPS)Logs were not collected from a data source for an abnormally long timeMicrosoft 365 storage services exfiltration activityMultiple Azure AD admin role removalsRisk indicators detected in emailSuspicious identity downloaded multiple objects from a bucketImproved logic of 314 Informational Analytics BIOCsA Kubernetes ConfigMap was created or deletedA Kubernetes Cronjob was createdA Kubernetes DaemonSet was createdA Kubernetes Pod was created with a sidecar containerA Kubernetes Pod was deletedA Kubernetes ReplicaSet was createdA Kubernetes StatefulSet was createdA Kubernetes cluster role binding was created or deletedA Kubernetes cluster was created or deletedA Kubernetes deployment was createdA Kubernetes ephemeral container was createdA Kubernetes namespace was created or deletedA Kubernetes node service account activity from external IPA Kubernetes role binding was created or deletedA Kubernetes secret was created or deletedA Kubernetes service account executed an unusual API callA Kubernetes service account has enumerated its permissionsA Kubernetes service account was created or deletedA Kubernetes service was created or deletedA New Server was Added to an Azure Active Directory Hybrid Health ADFS EnvironmentA Service Principal was created in AzureA Service Principal was removed from AzureA cloud identity created or modified a security groupA cloud identity executed an API call from an unusual countryA cloud identity had escalated its permissionsA cloud identity invoked IAM related persistence operationsA cloud identity started a Cloud Shell sessionA cloud instance was stoppedA cloud snapshot of AWS database or storage was modified or sharedA cloud storage configuration was modifiedA compute-attached identity executed API calls outside the instance's regionA container registry was created or deletedA new Azure email domain verification was requestedA rare DLL, signed by an uncommon vendor, was hijacked into a Microsoft processA user logged in to the AWS console for the first timeAWS Backup recovery point deletionAWS CloudTrail has been stoppedAWS CloudTrail modificationAWS CloudWatch log group deletionAWS CloudWatch log stream deletionAWS Config Recorder stoppedAWS EBS snapshot deletionAWS EC2 instance exported into S3AWS Flow Logs deletionAWS IAM resource group deletionAWS RDS cluster deletionAWS Root account activityAWS S3 object deletionAWS SES account sending settings modifiedAWS SSM parameters discoveryAWS SSM parameters retrievalAWS SSM send command attemptAWS STS temporary credentials were generatedAWS Secrets Manager AccessAWS Secrets Manager discoveryAWS SecurityHub findings were modifiedAWS Storage Gateway enumerationAWS Storage Gateway file share enumerationAWS Transfer Family server createdAWS config resource deletionAWS network ACL rule creationAWS network ACL rule deletionAWS user creationAccess to Kubernetes configuration fileActivity in a dormant region of a cloud projectAn AWS EFS File-share mount was deletedAn AWS EFS file-share was deletedAn AWS EKS cluster was created or deletedAn AWS GuardDuty IP set was createdAn AWS Lambda Function was createdAn AWS Lambda function was modifiedAn AWS RDS Global Cluster DeletionAn AWS RDS instance was created from a snapshotAn AWS Route 53 domain was transferred to another AWS accountAn AWS S3 bucket configuration was modifiedAn AWS SAML provider was modifiedAn AWS SES identity was deletedAn AWS database service master user password was changedAn Azure DNS Zone was modifiedAn Azure Firewall rule collection group was modified or deletedAn Azure Firewall was modifiedAn Azure Key Vault key was modifiedAn Azure Key Vault was modifiedAn Azure Kubernetes Cluster was created or deletedAn Azure Kubernetes Role or Cluster-Role was modifiedAn Azure Kubernetes Role-Binding or Cluster-Role-Binding was modified or deletedAn Azure Kubernetes Service Account was modified or deletedAn Azure Network Security Group was modifiedAn Azure Point-to-Site VPN was modifiedAn Azure Suppression Rule was createdAn Azure VPN Connection was modifiedAn Azure application reached a throttling API rateAn Azure firewall rule group was modifiedAn Azure virtual network Device was modifiedAn Azure virtual network was modifiedAn EBS snapshot block was downloadedAn Email address was added to AWS SESAn IAM group was createdAn identity accessed Azure Kubernetes SecretsAn identity accessed a cloud storage for the first timeAn identity accessed cloud storage containing sensitive dataAn identity attached an administrative policy to an IAM user or roleAn identity created or updated password for an IAM userAn identity disabled bucket loggingAn identity started an AWS SSM sessionAn identity was granted permissions to manage user access to Azure resourcesAn operation was performed by an identity from a domain that was not seen in the organizationAn unknown account was invited to the AWS organizationAn unusual cloud identity was granted permissions to a BigQuery resourceAppleScript executed a shell scriptAppleScript interpreter dynamic library loaded into a processAttempted Azure application access from unknown tenantAurora DB cluster stoppedAuthentication method added to an Azure accountAuthentication method was added to Azure accountAzure AD PIM elevation requestAzure AD account unlock/password reset attemptAzure Automation Account CreationAzure Automation Runbook Creation/ModificationAzure Automation Runbook DeletionAzure Automation Webhook creationAzure Blob Container Access Level ModificationAzure Event Hub Authorization rule creation/modificationAzure Key Vault Secrets were modifiedAzure Key Vault modificationAzure Kubernetes events were deletedAzure Resource Group DeletionAzure Service principal/Application creationAzure Storage Account key generatedAzure Temporary Access Pass (TAP) registered to an accountAzure account creation by a non-standard accountAzure application URI modificationAzure application consentAzure application credentials addedAzure application removedAzure conditional access policy creation or modificationAzure device code authentication flow usedAzure diagnostic configuration deletionAzure group creation/deletionAzure mailbox rule creationAzure permission delegation grantedAzure service principal assigned app roleAzure storage account blob anonymous access is enabledAzure storage account cross-tenant object replication was enabledAzure storage account was publicly sharedAzure user creation/deletionAzure user password resetAzure virtual machine commands executionBigQuery table or query results exfiltrated to a foreign projectBitLocker key retrievalCloud Organizational policy was created or modifiedCloud Watch alarm deletionCloud access key creationCloud compute instance user data script modificationCloud compute serial console accessCloud compute volume creation attemptCloud email sending was enabledCloud email service activityCloud identity reached a throttling API rateCloud impersonation attempt by unusual identity typeCloud instance creation attemptCloud instance deletion attemptCloud resource logging was disabledCloud snapshot created or modifiedCloud storage automatic backup disabledCloud storage delete protection disabledCloudTrail logging deletionCredentials were added to Azure applicationData encryption was disabledDenied API call by a Kubernetes service accountDevice Registration Policy modificationEBS snapshots were created from an EC2 instanceEBS volume attachment attemptEBS volume detachment attemptEC2 snapshot attribute has been modifiedEmail attachment with a potentially malicious file extensionEmail attachment with multiple extensionsEmail attachment(s) with potentially malicious MIME typeEmail containing a link with an IP address convention was detectedEmail containing a redirected linkEmail contains URL delivering high-risk file typeEmail has a short body or subject and was sent from an external sourceEmail marked as spam and bulk based on Spam Confidence Level and Bulk Complaint Level valuesEmail mimics replies or forwards without an actual ongoing conversationEmail was received from an unknown address using a public provider domainEmail was received from an unknown sender using a recognized domainEmail with URL shortener detectedEmail with file-sharing link containing auto-download parameterExternal email display name impersonation of internal personnelExternal email with a single internal recipient hidden in BCCExternal user invitation to Azure tenantFirst-seen email from mailbox owner to external recipient's address in the last 30 daysGCP Firewall Rule ModificationGCP Firewall Rule creationGCP IAM Role DeletionGCP IAM Service Account Key DeletionGCP Logging Bucket DeletionGCP Pub/Sub Subscription DeletionGCP Pub/Sub Topic DeletionGCP Service Account DisableGCP Service Account creationGCP Service Account deletionGCP Service Account key creationGCP Storage Bucket Configuration ModificationGCP Storage Bucket Permissions ModificationGCP Storage Bucket deletionGCP VPC Firewall Rule DeletionGCP Virtual Private Cloud (VPC) Network DeletionGCP Virtual Private Network Route CreationGCP Virtual Private Network Route DeletionGCP logging sink deletionGCP logging sink modificationGCP sensitive Cloud Run role grantedGCP sensitive Deployment Manager role grantedGCP sensitive Functions role grantedGCP sensitive IAM role grantedGCP sensitive Secret Manager role grantedGCP sensitive compute role grantedGCP sensitive storage role grantedGCP set IAM policy activityGranting Access to an AccountIAM User added to an IAM groupIAM inline policy was added to groupIAM inline policy was added to roleIAM inline policy was added to userIAM instance profile associations were describedIAM instance profile was associated with EC2 instanceIAM instance profile was createdIAM instance profile was replaced for EC2 instanceIAM instance profiles were listedIAM policy default version was changedIAM policy version was createdIAM policy was attached to groupIAM policy was attached to roleIAM role trust policy modificationIAM role was createdIAM role-attached managed policies were listedIdentity assigned an Azure AD Administrator RoleKubernetes Pod Created With Sensitive VolumeKubernetes Pod Created with host Inter Process Communications (IPC) namespaceKubernetes Pod created with host process ID (PID) namespaceKubernetes Privileged Pod CreationKubernetes admission controller activityKubernetes cluster events deletionKubernetes network policy modificationKubernetes pod creation with host networkKubernetes secret enumeration activityKubernetes service account activity outside the clusterMFA device was removed/deactivated from an IAM userModification or Deletion of an Azure Application Gateway DetectedMoniker link detected in URL(s)Network sniffing detected in Cloud environmentObject versioning was disabledOneDrive file downloadOneDrive file uploadOneDrive folder creationOutbound email contains file-sharing service link sent to external recipientOutbound email includes an external BCC recipient observed for the first timeOwner added to Azure applicationOwner was added to Azure applicationPIM privilege member removalPenetration testing tool attemptPotential creation of persistent cloud credentialsPotential spoofing of internal domain spottedPrivileged role used by Azure applicationPunycode characters detected in URL(s)Rarely seen URL(s) within a well-known domain detected in your organization's emailRemote usage of AWS Lambda's roleRemote usage of VM Service Account tokenRemote usage of an App engine Service Account tokenRemote usage of an Azure Service Principal tokenRemoval of an Azure Owner from an Application or Service PrincipalS3 configuration deletionSerial console access was enabled in AWS accountSoft delete of cloud storage configuration was disabledSuccessful unusual guest user invitationSuspicious DKIM ResultSuspicious DMARC resultSuspicious MFA request reported by user in Entra IDSuspicious SPF ResultSuspicious Unicode character detected in emailSuspicious cloud compute instance SSH keys modification attemptUncommon Launch Agent persistency was registered or modifiedUncommon URL domain(s) in your organization detected in emailUncommon attempt at discovering a sensitive fileUncommon attempt at grabbing credentials from a sensitive fileUnpopular URL(s) detected in emailUnpopular domains detected in email URLs for a recipientUnrecognized internal address (AAD mismatch)Unusual AWS CLI/SDK activityUnusual AWS systems manager activityUnusual Conditional Access operation for an identityUnusual IAM enumeration activity by a non-user IdentityUnusual Identity and Access Management (IAM) activityUnusual Kubernetes secret accessUnusual access to Microsoft 365 storage servicesUnusual certificate management activityUnusual cloud identity impersonationUnusual exec into a Kubernetes PodUnusual hostname for the sending mail server in the email headersUnusual key management activityUnusual process accessed a macOS notes DB fileUnusual process accessed web browser cookiesUnusual process accessed web browser credentialsUnusual resource access by Azure applicationUnusual resource modification by newly seen IAM userUnusual resource modification/creationUnusual secret management activityUnverified domain added to Azure ADUsage of homograph characters detected in an emailUsage of homograph characters detected in an email attachment(s) nameUsage of homograph characters detected in an email's from headerUser installed an application in Microsoft Teams via Graph APIX-Forefront-Antispam-Report has flagged this email as a potential threatImproved logic of 27 Informational Analytics AlertsAbnormal Allocation of compute resources in multiple regionsAllocation of multiple cloud compute resourcesAn Azure identity performed multiple actions that were deniedAn identity performed a suspicious download of multiple cloud storage objectsAzure enumeration activity using Microsoft Graph APIAzure uncommon increase in API request sizesCloud email infrastructure enumeration activityCloud infrastructure enumeration activityCloud user performed multiple actions that were deniedDeletion of multiple cloud resourcesIAM Enumeration sequenceKubernetes enumeration activityLog enumeration via cloud native logging serviceMailbox enumeration activity by Azure applicationMicrosoft OneDrive enumeration activityMicrosoft OneNote enumeration activityMicrosoft SharePoint enumeration activityMicrosoft Teams enumeration activityMulti region enumeration activityMultiple cloud snapshots exportMultiple failed logins from a single IPNumerous emails sent by a single sender to multiple internal recipientsShort-lived Azure AD user accountStorage enumeration activitySuspicious secrets dump activityUnusual attachment volume in outbound emailsUser sent messages in Microsoft Teams to multiple conversations via Graph APIIncreased the severity to Low for an Analytics BIOCSending unusual file(s) to an external addressChanged metadata of a Medium Analytics BIOCPhantom DLL LoadingChanged metadata of 5 Low Analytics BIOCsClickFix - PowerShell executed through the run applicationContained process execution with a rare GitHub URLPossible DLL Search Order HijackingSuspicious access of the System Management ContainerUncommon remote monitoring and management toolChanged metadata of a Low Analytics AlertUser collected remote shared files in an archiveChanged metadata of 10 Informational Analytics BIOCsAn unusual archive file creation by a userExecutable moved to Windows system folderGlobally uncommon high entropy process was executedGlobally uncommon image load from a signed processPossible DLL Hijack into a Microsoft processPossible DLL Side-LoadingRare signature signed executable executed in the networkUncommon access to cloud platforms' sensitive files by a scripting engineUnsigned DLL Hijack into a Microsoft processUnusual use of a 'SysInternals' toolChanged metadata of 7 Informational Analytics AlertsA user accessed multiple unusual resources via SSOA user performed suspiciously massive file activityA user printed an unusual number of filesExternal user created a Microsoft Teams conversation with suspicious operationsPossible data exfiltration over a USB storage devicePossible internal data exfiltration over a USB storage deviceUser exported multiple messages in Microsoft Teams via Graph API