2024.05.01

Release date: 16-May-2024

Change type	Changes
Added a new Medium Analytics BIOC	Kubernetes scanning activity
Added 5 new Low Analytics BIOCs	Abnormal Communication to Rare IP Abnormal Recurring Communications to Rare IP Known service display name with uncommon image-path Known service name with an uncommon image-path Kubernetes pod creation from unknown container image registry
Added 4 new Informational Analytics BIOCs	A Kubernetes Pod was created with a sidecar container First SSO Resource Access in the Organization Okta admin privilege assignment Weakly-Encrypted Kerberos TGT Response
Improved logic of a High Analytics BIOC	Editing ld.so.preload for persistence and injection
Improved logic of 3 Medium Analytics BIOCs	A TCP stream was created directly in a shell Execution of the Hydra Linux password brute-force tool Recurring rare domain access from an unsigned process
Improved logic of a Medium Analytics Alert	New Administrative Behavior
Improved logic of 4 Low Analytics BIOCs	Azure domain federation settings modification attempt Rare file transfer over SMB protocol Suspicious domain suffix Suspicious process modified an SSH authorized_keys file
Improved logic of 2 Low Analytics Alerts	Failed Connections Large Upload (Generic)
Improved logic of 5 Informational Analytics BIOCs	A cloud snapshot was created or modified AWS SSM send command attempt Rare AppID usage to a rare destination Rare process execution by user Rare process execution in organization
Improved logic of 3 Informational Analytics Alerts	Multiple Rare Process Executions in Organization Port Scan SSH authentication brute force attempts
Decreased the severity to Informational for 3 Analytics BIOCs	Azure application URI modification Rare DCOM RPC activity Rare Scheduled Task RPC activity
Changed metadata of a Medium Analytics BIOC	Azure AD PIM alert disabled
Changed metadata of 6 Low Analytics BIOCs	A GCP service account was delegated domain-wide authority in Google Workspace A domain was added to the trusted domains list Microsoft Office injects code into a process Rare Windows Remote Management (WinRM) HTTP Activity Rare service DLL was added to the registry Uncommon SSH session was established
Changed metadata of 6 Low Analytics Alerts	Abnormal SMB activity to multiple hosts Abnormal sensitive RPC traffic to multiple hosts Large Upload (FTP) Large Upload (HTTPS) Large Upload (SMTP) Spam Bot Traffic
Changed metadata of 6 Informational Analytics BIOCs	A Google Workspace service was configured as unrestricted Cloud Organizational policy was created or modified Globally uncommon injection from a signed process Gmail delegation was turned on for the organization Google Marketplace restrictions were modified Google Workspace third-party application's security settings were changed