2024.07.10

Release date: 24-July-2024

Change type	Changes
Added 2 new Low Analytics BIOCs	A rare file path was added to the AppInit_DLLs registry value FTP Connection Using an Anonymous Login or Default Credentials
Added 4 new Informational Analytics BIOCs	A user modified an Okta network zone A user queried AD CS objects via LDAP Kubernetes admission controller activity Unusual exec into a Kubernetes Pod
Added 2 new Informational Analytics Alerts	A user executed multiple LDAP enumeration queries Sensitive Exchange mail sent to external users
Improved logic of a High Analytics BIOC	Remote service command execution from an uncommon source
Improved logic of 7 Medium Analytics BIOCs	A Kubernetes API operation was successfully invoked by an anonymous user A TCP stream was created directly in a shell Discovery of misconfigured certificate templates using LDAP Penetration testing tool activity PowerShell runs suspicious base64-encoded commands Remote WMI process execution Windows LOLBIN executable connected to a rare external host
Improved logic of 2 Medium Analytics Alerts	DNS Tunneling New Administrative Behavior
Improved logic of 29 Low Analytics BIOCs	A suspicious direct syscall was executed AWS Flow Logs deletion An uncommon service was started An unpopular process accessed the microphone on the host Attempt to execute a command on a remote host using PsExec.exe Cached credentials discovery with cmdkey Microsoft Office process spawns a commonly abused process Non-browser access to a pastebin-like site Possible network service discovery via command-line tool RDP connections enabled remotely via Registry Rare SMB session to a remote host Rare Windows Remote Management (WinRM) HTTP Activity Rare scheduled task created Remote DCOM command execution Remote service start from an uncommon source Sensitive browser credential files accessed by a rare non browser process Suspicious PowerShell Command Line Suspicious RunOnce Parent Process Suspicious module load using direct syscall Suspicious process execution by scheduled task Suspicious runonce.exe parent process Suspicious sshpass command execution Uncommon ARP cache listing via arp.exe Uncommon IP Configuration Listing via ipconfig.exe Uncommon Remote Monitoring and Management Tool Uncommon local scheduled task creation via schtasks.exe Uncommon routing table listing via route.exe WmiPrvSe.exe Rare Child Command Line Wsmprovhost.exe Rare Child Process
Improved logic of 3 Low Analytics Alerts	Abnormal SMB activity to multiple hosts Failed Connections Large Upload (Generic)
Improved logic of 17 Informational Analytics BIOCs	A browser extension was installed or loaded in an uncommon way A process connected to a rare external host A suspicious process queried AD CS objects via LDAP An uncommon file was created in the startup folder Browser bookmark files accessed by a rare non-browser process Command execution via wmiexec Kubernetes secret enumeration activity LDAP traffic from non-standard process Possible LDAP Enumeration Tool Usage Remote PsExec-like command execution Remote code execution into Kubernetes Pod Tampering with the Windows User Account Controls (UAC) configuration Uncommon communication to an instant messaging server Uncommon net group or localgroup execution Unusual Kubernetes service account file read Unusual cloud identity impersonation User attempted to connect from a suspicious country
Improved logic of 4 Informational Analytics Alerts	External Login Password Spray Multiple discovery commands on a Linux host by the same process Port Scan User and Group Enumeration via SAMR
Decreased the severity to Informational for an Analytics BIOC	Local user account creation
Changed metadata of an Informational Analytics BIOC	EC2 snapshot attribute has been modified
Removed an old Informational Analytics BIOC	Log4J exploitation attempt against cloud hosted resources
Temporarily removed a Low Analytics BIOC for improvement	Suspicious domain suffix