> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2024-07-10.md).

# 2024.07.10

**Release date: 24-July-2024**

| Change type                                                   | Changes                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| ------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Added 2 new Low Analytics BIOCs                               | <ul><li><a href="/analytics-alerts/alerts-by-name/a-rare-file-path-was-added-to-the-appinit-dlls-registry-value.md">A rare file path was added to the AppInit\_DLLs registry value</a></li><li><a href="/analytics-alerts/alerts-by-name/ftp-connection-using-an-anonymous-login-or-default-credentials.md">FTP Connection Using an Anonymous Login or Default Credentials</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| Added 4 new Informational Analytics BIOCs                     | <ul><li><a href="/analytics-alerts/alerts-by-name/a-user-modified-an-okta-network-zone.md">A user modified an Okta network zone</a></li><li><a href="/analytics-alerts/alerts-by-name/a-user-queried-ad-cs-objects-via-ldap.md">A user queried AD CS objects via LDAP</a></li><li><a href="/analytics-alerts/alerts-by-name/kubernetes-admission-controller-activity.md">Kubernetes admission controller activity</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-exec-into-a-kubernetes-pod.md">Unusual exec into a Kubernetes Pod</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| Added 2 new Informational Analytics Alerts                    | <ul><li><a href="/analytics-alerts/alerts-by-name/a-user-executed-multiple-ldap-enumeration-queries.md">A user executed multiple LDAP enumeration queries</a></li><li><a href="/analytics-alerts/alerts-by-name/sensitive-exchange-mail-sent-to-external-users.md">Sensitive Exchange mail sent to external users</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| Improved logic of a High Analytics BIOC                       | <ul><li><a href="/analytics-alerts/alerts-by-name/remote-service-command-execution-from-an-uncommon-source.md">Remote service command execution from an uncommon source</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| Improved logic of 7 Medium Analytics BIOCs                    | <ul><li><a href="/analytics-alerts/alerts-by-name/a-kubernetes-api-operation-was-successfully-invoked-by-an-anonymous-user.md">A Kubernetes API operation was successfully invoked by an anonymous user</a></li><li><a href="/analytics-alerts/alerts-by-name/a-tcp-stream-was-created-directly-in-a-shell.md">A TCP stream was created directly in a shell</a></li><li><a href="/analytics-alerts/alerts-by-name/discovery-of-misconfigured-certificate-templates-using-ldap.md">Discovery of misconfigured certificate templates using LDAP</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Penetration testing tool activity</a></li><li><a href="/analytics-alerts/alerts-by-name/powershell-runs-suspicious-base64-encoded-commands.md">PowerShell runs suspicious base64-encoded commands</a></li><li><a href="/analytics-alerts/alerts-by-name/remote-wmi-process-execution.md">Remote WMI process execution</a></li><li><a href="/analytics-alerts/alerts-by-name/windows-lolbin-executable-connected-to-a-rare-external-host.md">Windows LOLBIN executable connected to a rare external host</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| Improved logic of 2 Medium Analytics Alerts                   | <ul><li><a href="/analytics-alerts/alerts-by-name/dns-tunneling.md">DNS Tunneling</a></li><li><a href="/analytics-alerts/alerts-by-name/new-administrative-behavior.md">New Administrative Behavior</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| Improved logic of 29 Low Analytics BIOCs                      | <ul><li><a href="/analytics-alerts/alerts-by-name/a-suspicious-direct-syscall-was-executed.md">A suspicious direct syscall was executed</a></li><li><a href="/analytics-alerts/alerts-by-name/aws-flow-logs-deletion.md">AWS Flow Logs deletion</a></li><li><a href="/analytics-alerts/alerts-by-name/an-uncommon-service-was-started.md">An uncommon service was started</a></li><li><a href="/analytics-alerts/alerts-by-name/an-unpopular-process-accessed-the-microphone-on-the-host.md">An unpopular process accessed the microphone on the host</a></li><li><a href="/analytics-alerts/alerts-by-name/attempt-to-execute-a-command-on-a-remote-host-using-psexec-exe.md">Attempt to execute a command on a remote host using PsExec.exe</a></li><li><a href="/analytics-alerts/alerts-by-name/cached-credentials-discovery-with-cmdkey.md">Cached credentials discovery with cmdkey</a></li><li><a href="/analytics-alerts/alerts-by-name/microsoft-office-process-spawns-a-commonly-abused-process.md">Microsoft Office process spawns a commonly abused process</a></li><li><a href="/analytics-alerts/alerts-by-name/non-browser-access-to-a-pastebin-like-site.md">Non-browser access to a pastebin-like site</a></li><li><a href="/analytics-alerts/alerts-by-name/possible-network-service-discovery-via-command-line-tool.md">Possible network service discovery via command-line tool</a></li><li><a href="/analytics-alerts/alerts-by-name/rdp-connections-enabled-remotely-via-registry.md">RDP connections enabled remotely via Registry</a></li><li><a href="/analytics-alerts/alerts-by-name/rare-smb-session-to-a-remote-host.md">Rare SMB session to a remote host</a></li><li><a href="/analytics-alerts/alerts-by-name/rare-windows-remote-management-winrm-http-activity.md">Rare Windows Remote Management (WinRM) HTTP Activity</a></li><li><a href="/analytics-alerts/alerts-by-name/rare-scheduled-task-created.md">Rare scheduled task created</a></li><li><a href="/analytics-alerts/alerts-by-name/remote-dcom-command-execution.md">Remote DCOM command execution</a></li><li><a href="/analytics-alerts/alerts-by-name/remote-service-start-from-an-uncommon-source.md">Remote service start from an uncommon source</a></li><li><a href="/analytics-alerts/alerts-by-name/sensitive-browser-credential-files-accessed-by-a-rare-non-browser-process.md">Sensitive browser credential files accessed by a rare non browser process</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-powershell-command-line.md">Suspicious PowerShell Command Line</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-runonce-parent-process.md">Suspicious RunOnce Parent Process</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-module-load-using-direct-syscall.md">Suspicious module load using direct syscall</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Suspicious process execution by scheduled task</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-runonce-exe-parent-process.md">Suspicious runonce.exe parent process</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-sshpass-command-execution.md">Suspicious sshpass command execution</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-arp-cache-listing-via-arp-exe.md">Uncommon ARP cache listing via arp.exe</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-ip-configuration-listing-via-ipconfig-exe.md">Uncommon IP Configuration Listing via ipconfig.exe</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-remote-monitoring-and-management-tool.md">Uncommon Remote Monitoring and Management Tool</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-local-scheduled-task-creation-via-schtasks-exe.md">Uncommon local scheduled task creation via schtasks.exe</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-routing-table-listing-via-route-exe.md">Uncommon routing table listing via route.exe</a></li><li><a href="/analytics-alerts/alerts-by-name/wmiprvse-exe-rare-child-command-line.md">WmiPrvSe.exe Rare Child Command Line</a></li><li><a href="/analytics-alerts/alerts-by-name/wsmprovhost-exe-rare-child-process.md">Wsmprovhost.exe Rare Child Process</a></li></ul> |
| Improved logic of 3 Low Analytics Alerts                      | <ul><li><a href="/analytics-alerts/alerts-by-name/abnormal-smb-activity-to-multiple-hosts.md">Abnormal SMB activity to multiple hosts</a></li><li><a href="/analytics-alerts/alerts-by-name/failed-connections.md">Failed Connections</a></li><li><a href="/analytics-alerts/alerts-by-name/large-upload-generic.md">Large Upload (Generic)</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| Improved logic of 17 Informational Analytics BIOCs            | <ul><li><a href="/analytics-alerts/alerts-by-name/a-browser-extension-was-installed-or-loaded-in-an-uncommon-way.md">A browser extension was installed or loaded in an uncommon way</a></li><li><a href="/analytics-alerts/alerts-by-name/a-process-connected-to-a-rare-external-host.md">A process connected to a rare external host</a></li><li><a href="/analytics-alerts/alerts-by-name/a-suspicious-process-queried-ad-cs-objects-via-ldap.md">A suspicious process queried AD CS objects via LDAP</a></li><li><a href="/analytics-alerts/alerts-by-name/an-uncommon-file-was-created-in-the-startup-folder.md">An uncommon file was created in the startup folder</a></li><li><a href="/analytics-alerts/alerts-by-name/browser-bookmark-files-accessed-by-a-rare-non-browser-process.md">Browser bookmark files accessed by a rare non-browser process</a></li><li><a href="/analytics-alerts/alerts-by-name/command-execution-via-wmiexec.md">Command execution via wmiexec</a></li><li><a href="/analytics-alerts/alerts-by-name/kubernetes-secret-enumeration-activity.md">Kubernetes secret enumeration activity</a></li><li><a href="/analytics-alerts/alerts-by-name/ldap-traffic-from-non-standard-process.md">LDAP traffic from non-standard process</a></li><li><a href="/analytics-alerts/alerts-by-name/possible-ldap-enumeration-tool-usage.md">Possible LDAP Enumeration Tool Usage</a></li><li><a href="/analytics-alerts/alerts-by-name/remote-psexec-like-command-execution.md">Remote PsExec-like command execution</a></li><li><a href="/analytics-alerts/alerts-by-name/remote-code-execution-into-kubernetes-pod.md">Remote code execution into Kubernetes Pod</a></li><li><a href="/analytics-alerts/alerts-by-name/tampering-with-the-windows-user-account-controls-uac-configuration.md">Tampering with the Windows User Account Controls (UAC) configuration</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-communication-to-an-instant-messaging-server.md">Uncommon communication to an instant messaging server</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Uncommon net group or localgroup execution</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-kubernetes-service-account-file-read.md">Unusual Kubernetes service account file read</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-cloud-identity-impersonation.md">Unusual cloud identity impersonation</a></li><li><a href="/analytics-alerts/alerts-by-name/user-attempted-to-connect-from-a-suspicious-country.md">User attempted to connect from a suspicious country</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| Improved logic of 4 Informational Analytics Alerts            | <ul><li><a href="/analytics-alerts/alerts-by-name/external-login-password-spray.md">External Login Password Spray</a></li><li><a href="/analytics-alerts/alerts-by-name/multiple-discovery-commands-on-a-linux-host-by-the-same-process.md">Multiple discovery commands on a Linux host by the same process</a></li><li><a href="/analytics-alerts/alerts-by-name/port-scan.md">Port Scan</a></li><li><a href="/analytics-alerts/alerts-by-name/user-and-group-enumeration-via-samr.md">User and Group Enumeration via SAMR</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| Decreased the severity to Informational for an Analytics BIOC | <ul><li><a href="/analytics-alerts/alerts-by-name/local-user-account-creation.md">Local user account creation</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Changed metadata of an Informational Analytics BIOC           | <ul><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EC2 snapshot attribute has been modified</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| Removed an old Informational Analytics BIOC                   | <ul><li>Log4J exploitation attempt against cloud hosted resources</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Temporarily removed a Low Analytics BIOC for improvement      | <ul><li>Suspicious domain suffix</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2024-07-10.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.