> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2024-06-05.md).

# 2024.06.05

**Release date: 27-June-2024**

| Change type                                         | Changes                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| --------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Added 3 new Low Analytics BIOCs                     | <ul><li><a href="/analytics-alerts/alerts-by-name/a-user-attempted-to-bypass-okta-mfa.md">A user attempted to bypass Okta MFA</a></li><li><a href="/analytics-alerts/alerts-by-name/execution-of-an-uncommon-process-at-an-early-startup-stage-by-windows-system-binary.md">Execution of an uncommon process at an early startup stage by Windows system binary</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-process-accessed-web-browser-credentials.md">Unusual process accessed web browser credentials</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| Added 3 new Informational Analytics BIOCs           | <ul><li><a href="/analytics-alerts/alerts-by-name/a-browser-extension-was-installed-or-loaded-in-an-uncommon-way.md">A browser extension was installed or loaded in an uncommon way</a></li><li><a href="/analytics-alerts/alerts-by-name/rare-process-accessed-a-keychain-file.md">Rare process accessed a Keychain file</a></li><li><a href="/analytics-alerts/alerts-by-name/saas-suspicious-external-domain-user-activity.md">SaaS suspicious external domain user activity</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Added a new Informational Analytics Alert           | <ul><li><a href="/analytics-alerts/alerts-by-name/a-user-established-an-smb-connection-to-multiple-hosts.md">A user established an SMB connection to multiple hosts</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| Improved logic of 4 Medium Analytics BIOCs          | <ul><li><a href="/analytics-alerts/alerts-by-name/a-tcp-stream-was-created-directly-in-a-shell.md">A TCP stream was created directly in a shell</a></li><li><a href="/analytics-alerts/alerts-by-name/powershell-runs-suspicious-base64-encoded-commands.md">PowerShell runs suspicious base64-encoded commands</a></li><li><a href="/analytics-alerts/alerts-by-name/recurring-rare-domain-access-from-an-unsigned-process.md">Recurring rare domain access from an unsigned process</a></li><li><a href="/analytics-alerts/alerts-by-name/windows-lolbin-executable-connected-to-a-rare-external-host.md">Windows LOLBIN executable connected to a rare external host</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| Improved logic of a Medium Analytics Alert          | <ul><li><a href="/analytics-alerts/alerts-by-name/new-administrative-behavior.md">New Administrative Behavior</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| Improved logic of 22 Low Analytics BIOCs            | <ul><li><a href="/analytics-alerts/alerts-by-name/a-suspicious-direct-syscall-was-executed.md">A suspicious direct syscall was executed</a></li><li><a href="/analytics-alerts/alerts-by-name/an-uncommon-service-was-started.md">An uncommon service was started</a></li><li><a href="/analytics-alerts/alerts-by-name/an-unpopular-process-accessed-the-microphone-on-the-host.md">An unpopular process accessed the microphone on the host</a></li><li><a href="/analytics-alerts/alerts-by-name/microsoft-office-injects-code-into-a-process.md">Microsoft Office injects code into a process</a></li><li><a href="/analytics-alerts/alerts-by-name/microsoft-office-process-spawns-a-commonly-abused-process.md">Microsoft Office process spawns a commonly abused process</a></li><li><a href="/analytics-alerts/alerts-by-name/non-browser-access-to-a-pastebin-like-site.md">Non-browser access to a pastebin-like site</a></li><li><a href="/analytics-alerts/alerts-by-name/possible-network-service-discovery-via-command-line-tool.md">Possible network service discovery via command-line tool</a></li><li><a href="/analytics-alerts/alerts-by-name/recurring-rare-domain-access-to-dynamic-dns-domain.md">Recurring rare domain access to dynamic DNS domain</a></li><li><a href="/analytics-alerts/alerts-by-name/remote-usage-of-an-azure-managed-identity-token.md">Remote usage of an Azure Managed Identity token</a></li><li><a href="/analytics-alerts/alerts-by-name/sensitive-browser-credential-files-accessed-by-a-rare-non-browser-process.md">Sensitive browser credential files accessed by a rare non browser process</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-powershell-command-line.md">Suspicious PowerShell Command Line</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-runonce-parent-process.md">Suspicious RunOnce Parent Process</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-module-load-using-direct-syscall.md">Suspicious module load using direct syscall</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Suspicious process execution by scheduled task</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-runonce-exe-parent-process.md">Suspicious runonce.exe parent process</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-sshpass-command-execution.md">Suspicious sshpass command execution</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-arp-cache-listing-via-arp-exe.md">Uncommon ARP cache listing via arp.exe</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-ip-configuration-listing-via-ipconfig-exe.md">Uncommon IP Configuration Listing via ipconfig.exe</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-browser-extension-loaded.md">Uncommon browser extension loaded</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-local-scheduled-task-creation-via-schtasks-exe.md">Uncommon local scheduled task creation via schtasks.exe</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-routing-table-listing-via-route-exe.md">Uncommon routing table listing via route.exe</a></li><li><a href="/analytics-alerts/alerts-by-name/wsmprovhost-exe-rare-child-process.md">Wsmprovhost.exe Rare Child Process</a></li></ul> |
| Improved logic of 2 Low Analytics Alerts            | <ul><li><a href="/analytics-alerts/alerts-by-name/abnormal-sensitive-rpc-traffic-to-multiple-hosts.md">Abnormal sensitive RPC traffic to multiple hosts</a></li><li><a href="/analytics-alerts/alerts-by-name/large-upload-generic.md">Large Upload (Generic)</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| Improved logic of 20 Informational Analytics BIOCs  | <ul><li><a href="/analytics-alerts/alerts-by-name/a-browser-was-opened-in-private-mode.md">A browser was opened in private mode</a></li><li><a href="/analytics-alerts/alerts-by-name/a-non-browser-process-accessed-a-website-ui.md">A non-browser process accessed a website UI</a></li><li><a href="/analytics-alerts/alerts-by-name/a-process-connected-to-a-rare-external-host.md">A process connected to a rare external host</a></li><li><a href="/analytics-alerts/alerts-by-name/a-user-added-a-windows-firewall-rule.md">A user added a Windows firewall rule</a></li><li><a href="/analytics-alerts/alerts-by-name/a-user-created-a-pfx-file-for-the-first-time.md">A user created a pfx file for the first time</a></li><li><a href="/analytics-alerts/alerts-by-name/a-user-was-added-to-a-windows-security-group.md">A user was added to a Windows security group</a></li><li><a href="/analytics-alerts/alerts-by-name/browser-bookmark-files-accessed-by-a-rare-non-browser-process.md">Browser bookmark files accessed by a rare non-browser process</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Cloud Unusual Instance Metadata Service (IMDS) access</a></li><li><a href="/analytics-alerts/alerts-by-name/kubernetes-secret-enumeration-activity.md">Kubernetes secret enumeration activity</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Network traffic to a crypto miner related domain detected</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Possible DLL Side-Loading</a></li><li><a href="/analytics-alerts/alerts-by-name/possible-email-collection-using-outlook-rpc.md">Possible Email collection using Outlook RPC</a></li><li><a href="/analytics-alerts/alerts-by-name/rare-scheduled-task-rpc-activity.md">Rare Scheduled Task RPC activity</a></li><li><a href="/analytics-alerts/alerts-by-name/remote-code-execution-into-kubernetes-pod.md">Remote code execution into Kubernetes Pod</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-process-accessed-a-site-masquerading-as-google.md">Suspicious process accessed a site masquerading as Google</a></li><li><a href="/analytics-alerts/alerts-by-name/tampering-with-the-windows-user-account-controls-uac-configuration.md">Tampering with the Windows User Account Controls (UAC) configuration</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-getclipboarddata-api-function-invocation-of-a-possible-information-stealer.md">Uncommon GetClipboardData API function invocation of a possible information stealer</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-communication-to-an-instant-messaging-server.md">Uncommon communication to an instant messaging server</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-kubernetes-service-account-file-read.md">Unusual Kubernetes service account file read</a></li><li><a href="/analytics-alerts/alerts-by-name/user-accessed-saas-resource-via-anonymous-link.md">User accessed SaaS resource via anonymous link</a></li></ul>                                                                                                                                                                                                                                        |
| Improved logic of 7 Informational Analytics Alerts  | <ul><li><a href="/analytics-alerts/alerts-by-name/a-user-received-multiple-weakly-encrypted-service-tickets.md">A user received multiple weakly encrypted service tickets</a></li><li><a href="/analytics-alerts/alerts-by-name/external-saas-file-sharing-activity.md">External SaaS file-sharing activity</a></li><li><a href="/analytics-alerts/alerts-by-name/massive-file-downloads-from-saas-service.md">Massive file downloads from SaaS service</a></li><li><a href="/analytics-alerts/alerts-by-name/massive-upload-to-saas-service.md">Massive upload to SaaS service</a></li><li><a href="/analytics-alerts/alerts-by-name/multiple-discovery-commands-on-a-linux-host-by-the-same-process.md">Multiple discovery commands on a Linux host by the same process</a></li><li><a href="/analytics-alerts/alerts-by-name/port-scan.md">Port Scan</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-reconnaissance-using-ldap.md">Suspicious reconnaissance using LDAP</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| Changed metadata of a Low Analytics BIOC            | <ul><li><a href="/analytics-alerts/alerts-by-name/unusual-azure-ad-sync-module-load.md">Unusual Azure AD sync module load</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| Changed metadata of 3 Informational Analytics BIOCs | <ul><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Log4J exploitation attempt against cloud hosted resources</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-adconnect-database-file-access.md">Unusual ADConnect database file access</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-access-to-the-ad-sync-credential-files.md">Unusual access to the AD Sync credential files</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2024-06-05.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.