2024.06.05

Release date: 27-June-2024

Change type	Changes
Added 3 new Low Analytics BIOCs	A user attempted to bypass Okta MFA Execution of an uncommon process at an early startup stage by Windows system binary Unusual process accessed web browser credentials
Added 3 new Informational Analytics BIOCs	A browser extension was installed or loaded in an uncommon way Rare process accessed a Keychain file SaaS suspicious external domain user activity
Added a new Informational Analytics Alert	A user established an SMB connection to multiple hosts
Improved logic of 4 Medium Analytics BIOCs	A TCP stream was created directly in a shell PowerShell runs suspicious base64-encoded commands Recurring rare domain access from an unsigned process Windows LOLBIN executable connected to a rare external host
Improved logic of a Medium Analytics Alert	New Administrative Behavior
Improved logic of 22 Low Analytics BIOCs	A suspicious direct syscall was executed An uncommon service was started An unpopular process accessed the microphone on the host Microsoft Office injects code into a process Microsoft Office process spawns a commonly abused process Non-browser access to a pastebin-like site Possible network service discovery via command-line tool Recurring rare domain access to dynamic DNS domain Remote usage of an Azure Managed Identity token Sensitive browser credential files accessed by a rare non browser process Suspicious PowerShell Command Line Suspicious RunOnce Parent Process Suspicious module load using direct syscall Suspicious process execution by scheduled task Suspicious runonce.exe parent process Suspicious sshpass command execution Uncommon ARP cache listing via arp.exe Uncommon IP Configuration Listing via ipconfig.exe Uncommon browser extension loaded Uncommon local scheduled task creation via schtasks.exe Uncommon routing table listing via route.exe Wsmprovhost.exe Rare Child Process
Improved logic of 2 Low Analytics Alerts	Abnormal sensitive RPC traffic to multiple hosts Large Upload (Generic)
Improved logic of 20 Informational Analytics BIOCs	A browser was opened in private mode A non-browser process accessed a website UI A process connected to a rare external host A user added a Windows firewall rule A user created a pfx file for the first time A user was added to a Windows security group Browser bookmark files accessed by a rare non-browser process Cloud Unusual Instance Metadata Service (IMDS) access Kubernetes secret enumeration activity Network traffic to a crypto miner related domain detected Possible DLL Side-Loading Possible Email collection using Outlook RPC Rare Scheduled Task RPC activity Remote code execution into Kubernetes Pod Suspicious process accessed a site masquerading as Google Tampering with the Windows User Account Controls (UAC) configuration Uncommon GetClipboardData API function invocation of a possible information stealer Uncommon communication to an instant messaging server Unusual Kubernetes service account file read User accessed SaaS resource via anonymous link
Improved logic of 7 Informational Analytics Alerts	A user received multiple weakly encrypted service tickets External SaaS file-sharing activity Massive file downloads from SaaS service Massive upload to SaaS service Multiple discovery commands on a Linux host by the same process Port Scan Suspicious reconnaissance using LDAP
Changed metadata of a Low Analytics BIOC	Unusual Azure AD sync module load
Changed metadata of 3 Informational Analytics BIOCs	Log4J exploitation attempt against cloud hosted resources Unusual ADConnect database file access Unusual access to the AD Sync credential files