2024.03.27

Release date: 14-April-2024

Change type	Changes
Added 2 new Medium Analytics BIOCs	A Kubernetes API operation was successfully invoked by an anonymous user A Kubernetes dashboard service account was used outside the cluster
Added 2 new Low Analytics BIOCs	Rundll32.exe executes a rare unsigned module Suspicious domain suffix
Added 2 new Low Analytics Alerts	Abnormal SMB activity to multiple hosts HTTP with suspicious characteristics
Added 26 new Informational Analytics BIOCs	A Kubernetes ConfigMap was created or deleted A Kubernetes Cronjob was created A Kubernetes DaemonSet was created A Kubernetes Pod was deleted A Kubernetes ReplicaSet was created A Kubernetes StatefulSet was created A Kubernetes cluster role binding was created or deleted A Kubernetes cluster was created or deleted A Kubernetes deployment was created A Kubernetes ephemeral container was created A Kubernetes namespace was created or deleted A Kubernetes node service account activity from external IP A Kubernetes role binding was created or deleted A Kubernetes secret was created or deleted A Kubernetes service account has enumerated its permissions A Kubernetes service account was created or deleted A Kubernetes service was created or deleted Command execution in a Kubernetes pod Kubernetes Pod Created With Sensitive Volume Kubernetes Pod created with host process ID (PID) namespace Kubernetes Privileged Pod Creation Kubernetes cluster events deletion Kubernetes network policy modification Kubernetes pod creation with host network Remote code execution into Kubernetes Pod Unusual Kubernetes service account file read
Added a new Informational Analytics Alert	Kubernetes enumeration activity
Improved logic of a Medium Analytics BIOC	Suspicious disablement of the Windows Firewall
Improved logic of 2 Medium Analytics Alerts	DNS Tunneling Sudoedit Brute force attempt
Improved logic of 5 Low Analytics BIOCs	Abnormal network communication through TOR using an uncommon port Recurring rare domain access to dynamic DNS domain Suspicious sshpass command execution Unusual AWS user added to group Unusual compressed file password protection
Improved logic of 2 Low Analytics Alerts	Impossible traveler - SSO Large Upload (Generic)
Improved logic of 7 Informational Analytics BIOCs	An identity attached an administrative policy to an IAM user/role File transfer from unusual IP using known tools Permission Groups discovery commands Possible data obfuscation Rare AppID usage to a rare destination User attempted to connect from a suspicious country VM Detection attempt on Linux
Improved logic of an Informational Analytics Alert	Port Scan
Changed metadata of 2 High Analytics BIOCs	Copy a process memory file Suspicious API call from a Tor exit node
Changed metadata of 2 Medium Analytics BIOCs	Execution of the Hydra Linux password brute-force tool Kubernetes vulnerability scanner activity
Changed metadata of 10 Low Analytics BIOCs	An uncommon service was started Change of sudo caching configuration Installation of a new System-V service Keylogging using system commands Masquerading as the Linux crond process Setuid and Setgid file bit manipulation Suspicious process changed or created the ssh_authorized_keys file Suspicious process modified RC script file Unusual Kubernetes API server communication from a pod Unusual Kubernetes dashboard communication from a pod
Changed metadata of 20 Informational Analytics BIOCs	A cloud identity executed an API call from an unusual country A compressed file was exfiltrated over SSH A container registry was created or deleted Adding execution privileges Cloud Unusual Instance Metadata Service (IMDS) access Indicator blocking Kubernetes nsenter container escape Kubernetes secret enumeration activity Kubernetes version disclosure Modification of PAM Network traffic to a crypto miner related domain detected Run downloaded script using pipe Suspicious access to shadow file Suspicious container runtime connection from within a Kubernetes Pod Suspicious curl user agent Suspicious docker image download from an unusual repository Suspicious process execution from tmp folder Suspicious process execution in a privileged container Uncommon kernel module load Unpopular rsync process execution
Changed metadata of an Informational Analytics Alert	Suspicious container reconnaissance activity in a Kubernetes pod
Removed an old Low Analytics Alert	Rare LDAP enumeration