2024.05.08

Release date: 27-May-2024

Change type	Changes
Added 2 new Low Analytics BIOCs	Rare RDP session to a remote host Scripting engine connected to a rare external host
Improved logic of 3 Medium Analytics BIOCs	Discovery of misconfigured certificate templates using LDAP Penetration testing tool activity Windows LOLBIN executable connected to a rare external host
Improved logic of 5 Low Analytics BIOCs	Azure account deletion by a non-standard account Linux system firewall was modified Recurring access to rare IP Suspicious process modified RC script file Suspicious process modified an SSH authorized_keys file
Improved logic of 2 Low Analytics Alerts	A user uploaded malware to SharePoint or OneDrive Spam Bot Traffic
Improved logic of 16 Informational Analytics BIOCs	A suspicious process queried AD CS objects via LDAP An uncommon file was created in the startup folder Authentication method added to an Azure account Azure AD account unlock/password reset attempt Azure account creation by a non-standard account Azure device code authentication flow used GCP set IAM policy activity Identity assigned an Azure AD Administrator Role Penetration testing tool activity attempt Penetration testing tool attempt Rare AppID usage to a rare destination SSO with abnormal user agent Signed process performed an unpopular DLL injection Signed process performed an unpopular injection Unusual Identity and Access Management (IAM) activity Unusual resource modification by newly seen IAM user
Decreased the severity to Informational for an Analytics BIOC	A WMI subscriber was created
Decreased the severity to Informational for 2 Analytics Alerts	Abnormal Allocation of compute resources in multiple regions Suspicious reconnaissance using LDAP
Changed metadata of a Medium Analytics BIOC	Uncommon Service Create/Config
Changed metadata of a Medium Analytics Alert	DNS Tunneling
Changed metadata of 7 Low Analytics BIOCs	Attempt to execute a command on a remote host using PsExec.exe Elevation to SYSTEM via services Known service display name with uncommon image-path Known service name with an uncommon image-path Rare service DLL was added to the registry Svchost.exe loads a rare unsigned module Uncommon remote service start via sc.exe
Changed metadata of an Informational Analytics BIOC	Service execution via sc.exe
Temporarily removed a Low Analytics BIOCs for improvement	Abnormal Communication to Rare IP Abnormal Recurring Communications to Rare IP Kubernetes pod creation from unknown container image registry