Analytics Content Version: 2025.11.19 - Content Update Release Notes - Cortex

Release date: 1 December, 2025

Change type	Changes
Added a new Low Analytics Alert	Suspicious activity indicating a potential abuse of a cloud-native email service
Added 9 new Informational Analytics BIOCs	An identity accessed a backup cloud storage An unusual read activity of cloud object Bucket's block public access setting turned off Bucket's object ownership controls were modified EC2 instance Amazon machine image was created Foreign account was granted permissions to S3 bucket via resource-based policy GCP administrative role granted to a cloud identity Local group enumeration via RPC Uncommon Launch Daemon persistency was registered or modified
Added a new Informational Analytics Alert	An identity initiated a download of multiple cloud objects
Improved logic of a High Analytics BIOC	Suspicious API call from a Tor exit node
Improved logic of a High Analytics Alert	Suspicious objects encryption in an AWS bucket
Improved logic of 10 Medium Analytics BIOCs	A Kubernetes API operation was successfully invoked by an anonymous user A Kubernetes dashboard service account was used outside the cluster A cloud storage object was copied to a foreign cloud account Azure AD PIM alert disabled Cloud snapshot of a database or storage instance was publicly shared Kubernetes vulnerability scanning tool usage Logging was impaired via external encryption key Penetration testing tool activity Suspicious heavy allocation of compute resources - possible mining activity Suspicious usage of EC2 token
Improved logic of 36 Low Analytics BIOCs	A Backup vault policy was modified A Command Line Interface (CLI) command was executed from a GCP serverless compute service A Command Line Interface (CLI) command was executed from an AWS serverless compute service A cloud function was created with an unusual runtime AWS Guard-Duty detector deletion AWS S3 bucket was exposed to public access AWS data asset shared public AWS web ACL deletion An Azure Firewall policy deletion An RDS snapshot was exported to an unknown S3 bucket An S3 replication policy to an unknown bucket was created Azure AD PIM role settings change Azure Event Hub Deletion Azure Network Watcher Deletion Azure account deletion by a non-standard account Azure domain federation settings modification attempt Billing admin role was removed Conditional Access policy removed Disable encryption operations Email attachment with Right-to-Left Override Unicode character Email was received from an unknown sender using a disposable domain Execution of an uncommon process at an early startup stage by Windows system binary Execution of an uncommon process with a local/domain user SID at an early startup stage by Windows system binary First Azure AD PowerShell operation for a user GCP data asset shared public Kubernetes pod creation from unknown container image registry MFA was disabled for an Azure identity Rare process executed by an AppleScript Remote usage of an AWS service token Remote usage of an Azure Managed Identity token Uncommon local scheduled task creation via schtasks.exe Unsigned process execution by scheduled task Unusual cross projects activity Unusual process accessed a crypto wallet's files Unusual process accessed a messaging app's files Unusual process accessed a web browser history file
Improved logic of 6 Low Analytics Alerts	Large Upload (HTTPS) Logs were not collected from a data source for an abnormally long time Microsoft 365 storage services exfiltration activity Multiple Azure AD admin role removals Risk indicators detected in email Suspicious identity downloaded multiple objects from a bucket
Improved logic of 314 Informational Analytics BIOCs	A Kubernetes ConfigMap was created or deleted A Kubernetes Cronjob was created A Kubernetes DaemonSet was created A Kubernetes Pod was created with a sidecar container A Kubernetes Pod was deleted A Kubernetes ReplicaSet was created A Kubernetes StatefulSet was created A Kubernetes cluster role binding was created or deleted A Kubernetes cluster was created or deleted A Kubernetes deployment was created A Kubernetes ephemeral container was created A Kubernetes namespace was created or deleted A Kubernetes node service account activity from external IP A Kubernetes role binding was created or deleted A Kubernetes secret was created or deleted A Kubernetes service account executed an unusual API call A Kubernetes service account has enumerated its permissions A Kubernetes service account was created or deleted A Kubernetes service was created or deleted A New Server was Added to an Azure Active Directory Hybrid Health ADFS Environment A Service Principal was created in Azure A Service Principal was removed from Azure A cloud identity created or modified a security group A cloud identity executed an API call from an unusual country A cloud identity had escalated its permissions A cloud identity invoked IAM related persistence operations A cloud identity started a Cloud Shell session A cloud instance was stopped A cloud snapshot of AWS database or storage was modified or shared A cloud storage configuration was modified A compute-attached identity executed API calls outside the instance's region A container registry was created or deleted A new Azure email domain verification was requested A rare DLL, signed by an uncommon vendor, was hijacked into a Microsoft process A user logged in to the AWS console for the first time AWS Backup recovery point deletion AWS CloudTrail has been stopped AWS CloudTrail modification AWS CloudWatch log group deletion AWS CloudWatch log stream deletion AWS Config Recorder stopped AWS EBS snapshot deletion AWS EC2 instance exported into S3 AWS Flow Logs deletion AWS IAM resource group deletion AWS RDS cluster deletion AWS Root account activity AWS S3 object deletion AWS SES account sending settings modified AWS SSM parameters discovery AWS SSM parameters retrieval AWS SSM send command attempt AWS STS temporary credentials were generated AWS Secrets Manager Access AWS Secrets Manager discovery AWS SecurityHub findings were modified AWS Storage Gateway enumeration AWS Storage Gateway file share enumeration AWS Transfer Family server created AWS config resource deletion AWS network ACL rule creation AWS network ACL rule deletion AWS user creation Access to Kubernetes configuration file Activity in a dormant region of a cloud project An AWS EFS File-share mount was deleted An AWS EFS file-share was deleted An AWS EKS cluster was created or deleted An AWS GuardDuty IP set was created An AWS Lambda Function was created An AWS Lambda function was modified An AWS RDS Global Cluster Deletion An AWS RDS instance was created from a snapshot An AWS Route 53 domain was transferred to another AWS account An AWS S3 bucket configuration was modified An AWS SAML provider was modified An AWS SES identity was deleted An AWS database service master user password was changed An Azure DNS Zone was modified An Azure Firewall rule collection group was modified or deleted An Azure Firewall was modified An Azure Key Vault key was modified An Azure Key Vault was modified An Azure Kubernetes Cluster was created or deleted An Azure Kubernetes Role or Cluster-Role was modified An Azure Kubernetes Role-Binding or Cluster-Role-Binding was modified or deleted An Azure Kubernetes Service Account was modified or deleted An Azure Network Security Group was modified An Azure Point-to-Site VPN was modified An Azure Suppression Rule was created An Azure VPN Connection was modified An Azure application reached a throttling API rate An Azure firewall rule group was modified An Azure virtual network Device was modified An Azure virtual network was modified An EBS snapshot block was downloaded An Email address was added to AWS SES An IAM group was created An identity accessed Azure Kubernetes Secrets An identity accessed a cloud storage for the first time An identity accessed cloud storage containing sensitive data An identity attached an administrative policy to an IAM user or role An identity created or updated password for an IAM user An identity disabled bucket logging An identity started an AWS SSM session An identity was granted permissions to manage user access to Azure resources An operation was performed by an identity from a domain that was not seen in the organization An unknown account was invited to the AWS organization An unusual cloud identity was granted permissions to a BigQuery resource AppleScript executed a shell script AppleScript interpreter dynamic library loaded into a process Attempted Azure application access from unknown tenant Aurora DB cluster stopped Authentication method added to an Azure account Authentication method was added to Azure account Azure AD PIM elevation request Azure AD account unlock/password reset attempt Azure Automation Account Creation Azure Automation Runbook Creation/Modification Azure Automation Runbook Deletion Azure Automation Webhook creation Azure Blob Container Access Level Modification Azure Event Hub Authorization rule creation/modification Azure Key Vault Secrets were modified Azure Key Vault modification Azure Kubernetes events were deleted Azure Resource Group Deletion Azure Service principal/Application creation Azure Storage Account key generated Azure Temporary Access Pass (TAP) registered to an account Azure account creation by a non-standard account Azure application URI modification Azure application consent Azure application credentials added Azure application removed Azure conditional access policy creation or modification Azure device code authentication flow used Azure diagnostic configuration deletion Azure group creation/deletion Azure mailbox rule creation Azure permission delegation granted Azure service principal assigned app role Azure storage account blob anonymous access is enabled Azure storage account cross-tenant object replication was enabled Azure storage account was publicly shared Azure user creation/deletion Azure user password reset Azure virtual machine commands execution BigQuery table or query results exfiltrated to a foreign project BitLocker key retrieval Cloud Organizational policy was created or modified Cloud Watch alarm deletion Cloud access key creation Cloud compute instance user data script modification Cloud compute serial console access Cloud compute volume creation attempt Cloud email sending was enabled Cloud email service activity Cloud identity reached a throttling API rate Cloud impersonation attempt by unusual identity type Cloud instance creation attempt Cloud instance deletion attempt Cloud resource logging was disabled Cloud snapshot created or modified Cloud storage automatic backup disabled Cloud storage delete protection disabled CloudTrail logging deletion Credentials were added to Azure application Data encryption was disabled Denied API call by a Kubernetes service account Device Registration Policy modification EBS snapshots were created from an EC2 instance EBS volume attachment attempt EBS volume detachment attempt EC2 snapshot attribute has been modified Email attachment with a potentially malicious file extension Email attachment with multiple extensions Email attachment(s) with potentially malicious MIME type Email containing a link with an IP address convention was detected Email containing a redirected link Email contains URL delivering high-risk file type Email has a short body or subject and was sent from an external source Email marked as spam and bulk based on Spam Confidence Level and Bulk Complaint Level values Email mimics replies or forwards without an actual ongoing conversation Email was received from an unknown address using a public provider domain Email was received from an unknown sender using a recognized domain Email with URL shortener detected Email with file-sharing link containing auto-download parameter External email display name impersonation of internal personnel External email with a single internal recipient hidden in BCC External user invitation to Azure tenant First-seen email from mailbox owner to external recipient's address in the last 30 days GCP Firewall Rule Modification GCP Firewall Rule creation GCP IAM Role Deletion GCP IAM Service Account Key Deletion GCP Logging Bucket Deletion GCP Pub/Sub Subscription Deletion GCP Pub/Sub Topic Deletion GCP Service Account Disable GCP Service Account creation GCP Service Account deletion GCP Service Account key creation GCP Storage Bucket Configuration Modification GCP Storage Bucket Permissions Modification GCP Storage Bucket deletion GCP VPC Firewall Rule Deletion GCP Virtual Private Cloud (VPC) Network Deletion GCP Virtual Private Network Route Creation GCP Virtual Private Network Route Deletion GCP logging sink deletion GCP logging sink modification GCP sensitive Cloud Run role granted GCP sensitive Deployment Manager role granted GCP sensitive Functions role granted GCP sensitive IAM role granted GCP sensitive Secret Manager role granted GCP sensitive compute role granted GCP sensitive storage role granted GCP set IAM policy activity Granting Access to an Account IAM User added to an IAM group IAM inline policy was added to group IAM inline policy was added to role IAM inline policy was added to user IAM instance profile associations were described IAM instance profile was associated with EC2 instance IAM instance profile was created IAM instance profile was replaced for EC2 instance IAM instance profiles were listed IAM policy default version was changed IAM policy version was created IAM policy was attached to group IAM policy was attached to role IAM role trust policy modification IAM role was created IAM role-attached managed policies were listed Identity assigned an Azure AD Administrator Role Kubernetes Pod Created With Sensitive Volume Kubernetes Pod Created with host Inter Process Communications (IPC) namespace Kubernetes Pod created with host process ID (PID) namespace Kubernetes Privileged Pod Creation Kubernetes admission controller activity Kubernetes cluster events deletion Kubernetes network policy modification Kubernetes pod creation with host network Kubernetes secret enumeration activity Kubernetes service account activity outside the cluster MFA device was removed/deactivated from an IAM user Modification or Deletion of an Azure Application Gateway Detected Moniker link detected in URL(s) Network sniffing detected in Cloud environment Object versioning was disabled OneDrive file download OneDrive file upload OneDrive folder creation Outbound email contains file-sharing service link sent to external recipient Outbound email includes an external BCC recipient observed for the first time Owner added to Azure application Owner was added to Azure application PIM privilege member removal Penetration testing tool attempt Potential creation of persistent cloud credentials Potential spoofing of internal domain spotted Privileged role used by Azure application Punycode characters detected in URL(s) Rarely seen URL(s) within a well-known domain detected in your organization's email Remote usage of AWS Lambda's role Remote usage of VM Service Account token Remote usage of an App engine Service Account token Remote usage of an Azure Service Principal token Removal of an Azure Owner from an Application or Service Principal S3 configuration deletion Serial console access was enabled in AWS account Soft delete of cloud storage configuration was disabled Successful unusual guest user invitation Suspicious DKIM Result Suspicious DMARC result Suspicious MFA request reported by user in Entra ID Suspicious SPF Result Suspicious Unicode character detected in email Suspicious cloud compute instance SSH keys modification attempt Uncommon Launch Agent persistency was registered or modified Uncommon URL domain(s) in your organization detected in email Uncommon attempt at discovering a sensitive file Uncommon attempt at grabbing credentials from a sensitive file Unpopular URL(s) detected in email Unpopular domains detected in email URLs for a recipient Unrecognized internal address (AAD mismatch) Unusual AWS CLI/SDK activity Unusual AWS systems manager activity Unusual Conditional Access operation for an identity Unusual IAM enumeration activity by a non-user Identity Unusual Identity and Access Management (IAM) activity Unusual Kubernetes secret access Unusual access to Microsoft 365 storage services Unusual certificate management activity Unusual cloud identity impersonation Unusual exec into a Kubernetes Pod Unusual hostname for the sending mail server in the email headers Unusual key management activity Unusual process accessed a macOS notes DB file Unusual process accessed web browser cookies Unusual process accessed web browser credentials Unusual resource access by Azure application Unusual resource modification by newly seen IAM user Unusual resource modification/creation Unusual secret management activity Unverified domain added to Azure AD Usage of homograph characters detected in an email Usage of homograph characters detected in an email attachment(s) name Usage of homograph characters detected in an email's from header User installed an application in Microsoft Teams via Graph API X-Forefront-Antispam-Report has flagged this email as a potential threat
Improved logic of 27 Informational Analytics Alerts	Abnormal Allocation of compute resources in multiple regions Allocation of multiple cloud compute resources An Azure identity performed multiple actions that were denied An identity performed a suspicious download of multiple cloud storage objects Azure enumeration activity using Microsoft Graph API Azure uncommon increase in API request sizes Cloud email infrastructure enumeration activity Cloud infrastructure enumeration activity Cloud user performed multiple actions that were denied Deletion of multiple cloud resources IAM Enumeration sequence Kubernetes enumeration activity Log enumeration via cloud native logging service Mailbox enumeration activity by Azure application Microsoft OneDrive enumeration activity Microsoft OneNote enumeration activity Microsoft SharePoint enumeration activity Microsoft Teams enumeration activity Multi region enumeration activity Multiple cloud snapshots export Multiple failed logins from a single IP Numerous emails sent by a single sender to multiple internal recipients Short-lived Azure AD user account Storage enumeration activity Suspicious secrets dump activity Unusual attachment volume in outbound emails User sent messages in Microsoft Teams to multiple conversations via Graph API
Increased the severity to Low for an Analytics BIOC	Sending unusual file(s) to an external address
Changed metadata of a Medium Analytics BIOC	Phantom DLL Loading
Changed metadata of 5 Low Analytics BIOCs	ClickFix - PowerShell executed through the run application Contained process execution with a rare GitHub URL Possible DLL Search Order Hijacking Suspicious access of the System Management Container Uncommon remote monitoring and management tool
Changed metadata of a Low Analytics Alert	User collected remote shared files in an archive
Changed metadata of 10 Informational Analytics BIOCs	An unusual archive file creation by a user Executable moved to Windows system folder Globally uncommon high entropy process was executed Globally uncommon image load from a signed process Possible DLL Hijack into a Microsoft process Possible DLL Side-Loading Rare signature signed executable executed in the network Uncommon access to cloud platforms' sensitive files by a scripting engine Unsigned DLL Hijack into a Microsoft process Unusual use of a 'SysInternals' tool
Changed metadata of 7 Informational Analytics Alerts	A user accessed multiple unusual resources via SSO A user performed suspiciously massive file activity A user printed an unusual number of files External user created a Microsoft Teams conversation with suspicious operations Possible data exfiltration over a USB storage device Possible internal data exfiltration over a USB storage device User exported multiple messages in Microsoft Teams via Graph API