2024.03.06

Release date: 28-March-2024

Change type	Changes
Added a new Low Analytics BIOC	Rare Windows Remote Management (WinRM) HTTP Activity
Added a new Informational Analytics BIOC	GCP set IAM policy activity
Improved logic of a Medium Analytics BIOC	A TCP stream was created directly in a shell
Improved logic of 2 Low Analytics BIOCs	Suspicious RunOnce Parent Process Uncommon local scheduled task creation via schtasks.exe
Improved logic of 2 Low Analytics Alerts	Large Upload (Generic) Large Upload (HTTPS)
Improved logic of 4 Informational Analytics BIOCs	Cloud Unusual Instance Metadata Service (IMDS) access Globally uncommon IP address by a common process (sha256) Globally uncommon root-domain port combination by a common process (sha256) Rare AppID usage to a rare destination
Improved logic of 3 Informational Analytics Alerts	Intense SSO failures Multiple discovery-like commands SSO Brute Force
Changed metadata of a Low Analytics BIOC	Uncommon msiexec execution of an arbitrary file from a remote location
Changed metadata of an Informational Analytics BIOC	Msiexec execution of an executable from an uncommon remote location