> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2024-05-08.md).

# 2024.05.08

**Release date: 27-May-2024**

| Change type                                                    | Changes                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Added 2 new Low Analytics BIOCs                                | <ul><li><a href="/analytics-alerts/alerts-by-name/rare-rdp-session-to-a-remote-host.md">Rare RDP session to a remote host</a></li><li><a href="/analytics-alerts/alerts-by-name/scripting-engine-connected-to-a-rare-external-host.md">Scripting engine connected to a rare external host</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| Improved logic of 3 Medium Analytics BIOCs                     | <ul><li><a href="/analytics-alerts/alerts-by-name/discovery-of-misconfigured-certificate-templates-using-ldap.md">Discovery of misconfigured certificate templates using LDAP</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Penetration testing tool activity</a></li><li><a href="/analytics-alerts/alerts-by-name/windows-lolbin-executable-connected-to-a-rare-external-host.md">Windows LOLBIN executable connected to a rare external host</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| Improved logic of 5 Low Analytics BIOCs                        | <ul><li><a href="/analytics-alerts/alerts-by-name/azure-account-deletion-by-a-non-standard-account.md">Azure account deletion by a non-standard account</a></li><li><a href="/analytics-alerts/alerts-by-name/linux-system-firewall-was-modified.md">Linux system firewall was modified</a></li><li><a href="/analytics-alerts/alerts-by-name/recurring-access-to-rare-ip.md">Recurring access to rare IP</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-process-modified-rc-script-file.md">Suspicious process modified RC script file</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Suspicious process modified an SSH authorized\_keys file</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| Improved logic of 2 Low Analytics Alerts                       | <ul><li><a href="/analytics-alerts/alerts-by-name/a-user-uploaded-malware-to-sharepoint-or-onedrive.md">A user uploaded malware to SharePoint or OneDrive</a></li><li><a href="/analytics-alerts/alerts-by-name/spam-bot-traffic.md">Spam Bot Traffic</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| Improved logic of 16 Informational Analytics BIOCs             | <ul><li><a href="/analytics-alerts/alerts-by-name/a-suspicious-process-queried-ad-cs-objects-via-ldap.md">A suspicious process queried AD CS objects via LDAP</a></li><li><a href="/analytics-alerts/alerts-by-name/an-uncommon-file-was-created-in-the-startup-folder.md">An uncommon file was created in the startup folder</a></li><li><a href="/analytics-alerts/alerts-by-name/authentication-method-added-to-an-azure-account.md">Authentication method added to an Azure account</a></li><li><a href="/analytics-alerts/alerts-by-name/azure-ad-account-unlock-password-reset-attempt.md">Azure AD account unlock/password reset attempt</a></li><li><a href="/analytics-alerts/alerts-by-name/azure-account-creation-by-a-non-standard-account.md">Azure account creation by a non-standard account</a></li><li><a href="https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/azure-device-code-authentication-flow-used">Azure device code authentication flow used</a></li><li><a href="/analytics-alerts/alerts-by-name/gcp-set-iam-policy-activity.md">GCP set IAM policy activity</a></li><li><a href="/analytics-alerts/alerts-by-name/identity-assigned-an-azure-ad-administrator-role.md">Identity assigned an Azure AD Administrator Role</a></li><li><a href="/analytics-alerts/alerts-by-name/penetration-testing-tool-activity-attempt.md">Penetration testing tool activity attempt</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Penetration testing tool attempt</a></li><li><a href="/analytics-alerts/alerts-by-name/rare-appid-usage-to-a-rare-destination.md">Rare AppID usage to a rare destination</a></li><li><a href="/analytics-alerts/alerts-by-name/sso-with-abnormal-user-agent.md">SSO with abnormal user agent</a></li><li><a href="/analytics-alerts/alerts-by-name/signed-process-performed-an-unpopular-dll-injection.md">Signed process performed an unpopular DLL injection</a></li><li><a href="/analytics-alerts/alerts-by-name/signed-process-performed-an-unpopular-injection.md">Signed process performed an unpopular injection</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-identity-and-access-management-iam-activity.md">Unusual Identity and Access Management (IAM) activity</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-resource-modification-by-newly-seen-iam-user.md">Unusual resource modification by newly seen IAM user</a></li></ul> |
| Decreased the severity to Informational for an Analytics BIOC  | <ul><li><a href="/analytics-alerts/alerts-by-name/a-wmi-subscriber-was-created.md">A WMI subscriber was created</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| Decreased the severity to Informational for 2 Analytics Alerts | <ul><li><a href="/analytics-alerts/alerts-by-name/abnormal-allocation-of-compute-resources-in-multiple-regions.md">Abnormal Allocation of compute resources in multiple regions</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-reconnaissance-using-ldap.md">Suspicious reconnaissance using LDAP</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| Changed metadata of a Medium Analytics BIOC                    | <ul><li><a href="/analytics-alerts/alerts-by-name/uncommon-service-create-config.md">Uncommon Service Create/Config</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| Changed metadata of a Medium Analytics Alert                   | <ul><li><a href="/analytics-alerts/alerts-by-name/dns-tunneling.md">DNS Tunneling</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| Changed metadata of 7 Low Analytics BIOCs                      | <ul><li><a href="/analytics-alerts/alerts-by-name/attempt-to-execute-a-command-on-a-remote-host-using-psexec-exe.md">Attempt to execute a command on a remote host using PsExec.exe</a></li><li><a href="/analytics-alerts/alerts-by-name/elevation-to-system-via-services.md">Elevation to SYSTEM via services</a></li><li><a href="/analytics-alerts/alerts-by-name/known-service-display-name-with-uncommon-image-path.md">Known service display name with uncommon image-path</a></li><li><a href="/analytics-alerts/alerts-by-name/known-service-name-with-an-uncommon-image-path.md">Known service name with an uncommon image-path</a></li><li><a href="/analytics-alerts/alerts-by-name/rare-service-dll-was-added-to-the-registry.md">Rare service DLL was added to the registry</a></li><li><a href="/analytics-alerts/alerts-by-name/svchost-exe-loads-a-rare-unsigned-module.md">Svchost.exe loads a rare unsigned module</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-remote-service-start-via-sc-exe.md">Uncommon remote service start via sc.exe</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| Changed metadata of an Informational Analytics BIOC            | <ul><li><a href="/analytics-alerts/alerts-by-name/service-execution-via-sc-exe.md">Service execution via sc.exe</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| Temporarily removed a Low Analytics BIOCs for improvement      | <ul><li>Abnormal Communication to Rare IP</li><li>Abnormal Recurring Communications to Rare IP</li><li>Kubernetes pod creation from unknown container image registry</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2024-05-08.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.