> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2024-07-17.md).

# 2024.07.17

**Release date: 01-August-2024**

| Change type                                          | Changes                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| ---------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Added a new Informational Analytics BIOC             | <ul><li><a href="/analytics-alerts/alerts-by-name/rare-dlp-rule-match-by-user.md">Rare DLP rule match by user</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| Improved logic of a High Analytics BIOC              | <ul><li><a href="/analytics-alerts/alerts-by-name/copy-a-process-memory-file.md">Copy a process memory file</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| Improved logic of 3 Medium Analytics BIOCs           | <ul><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Execution of the Hydra Linux password brute-force tool</a></li><li><a href="/analytics-alerts/alerts-by-name/recurring-rare-domain-access-from-an-unsigned-process.md">Recurring rare domain access from an unsigned process</a></li><li><a href="/analytics-alerts/alerts-by-name/windows-lolbin-executable-connected-to-a-rare-external-host.md">Windows LOLBIN executable connected to a rare external host</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| Improved logic of 19 Low Analytics BIOCs             | <ul><li><a href="/analytics-alerts/alerts-by-name/an-uncommon-service-was-started.md">An uncommon service was started</a></li><li><a href="/analytics-alerts/alerts-by-name/change-of-sudo-caching-configuration.md">Change of sudo caching configuration</a></li><li><a href="/analytics-alerts/alerts-by-name/compressing-data-using-python.md">Compressing data using python</a></li><li><a href="/analytics-alerts/alerts-by-name/copy-a-user-s-gnupg-directory-with-rsync.md">Copy a user's GnuPG directory with rsync</a></li><li><a href="/analytics-alerts/alerts-by-name/installation-of-a-new-system-v-service.md">Installation of a new System-V service</a></li><li><a href="/analytics-alerts/alerts-by-name/keylogging-using-system-commands.md">Keylogging using system commands</a></li><li><a href="/analytics-alerts/alerts-by-name/linux-system-firewall-was-modified.md">Linux system firewall was modified</a></li><li><a href="/analytics-alerts/alerts-by-name/masquerading-as-the-linux-crond-process.md">Masquerading as the Linux crond process</a></li><li><a href="/analytics-alerts/alerts-by-name/possible-dll-hijack-into-a-microsoft-process.md">Possible DLL Hijack into a Microsoft process</a></li><li><a href="/analytics-alerts/alerts-by-name/possible-dll-search-order-hijacking.md">Possible DLL Search Order Hijacking</a></li><li><a href="/analytics-alerts/alerts-by-name/rare-windows-remote-management-winrm-http-activity.md">Rare Windows Remote Management (WinRM) HTTP Activity</a></li><li><a href="/analytics-alerts/alerts-by-name/setuid-and-setgid-file-bit-manipulation.md">Setuid and Setgid file bit manipulation</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-process-modified-rc-script-file.md">Suspicious process modified RC script file</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Suspicious process modified an SSH authorized\_keys file</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-sshpass-command-execution.md">Suspicious sshpass command execution</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-at-task-job-creation-by-user.md">Uncommon AT task-job creation by user</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-creation-or-access-operation-of-sensitive-shadow-copy.md">Uncommon creation or access operation of sensitive shadow copy</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-compressed-file-password-protection.md">Unusual compressed file password protection</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-process-accessed-ftp-client-credentials.md">Unusual process accessed FTP Client credentials</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| Improved logic of 28 Informational Analytics BIOCs   | <ul><li><a href="/analytics-alerts/alerts-by-name/a-compressed-file-was-exfiltrated-over-ssh.md">A compressed file was exfiltrated over SSH</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Activity in a dormant region of a cloud project</a></li><li><a href="/analytics-alerts/alerts-by-name/adding-execution-privileges.md">Adding execution privileges</a></li><li><a href="/analytics-alerts/alerts-by-name/file-transfer-from-unusual-ip-using-known-tools.md">File transfer from unusual IP using known tools</a></li><li><a href="/analytics-alerts/alerts-by-name/indicator-blocking.md">Indicator blocking</a></li><li><a href="/analytics-alerts/alerts-by-name/kubernetes-pod-created-with-host-process-id-pid-namespace.md">Kubernetes Pod created with host process ID (PID) namespace</a></li><li><a href="/analytics-alerts/alerts-by-name/kubernetes-privileged-pod-creation.md">Kubernetes Privileged Pod Creation</a></li><li><a href="/analytics-alerts/alerts-by-name/kubernetes-pod-creation-with-host-network.md">Kubernetes pod creation with host network</a></li><li><a href="/analytics-alerts/alerts-by-name/kubernetes-version-disclosure.md">Kubernetes version disclosure</a></li><li><a href="/analytics-alerts/alerts-by-name/modification-of-pam.md">Modification of PAM</a></li><li><a href="/analytics-alerts/alerts-by-name/permission-groups-discovery-commands.md">Permission Groups discovery commands</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Possible DLL Side-Loading</a></li><li><a href="/analytics-alerts/alerts-by-name/possible-data-obfuscation.md">Possible data obfuscation</a></li><li><a href="/analytics-alerts/alerts-by-name/rare-process-accessed-a-keychain-file.md">Rare process accessed a Keychain file</a></li><li><a href="/analytics-alerts/alerts-by-name/run-downloaded-script-using-pipe.md">Run downloaded script using pipe</a></li><li><a href="/analytics-alerts/alerts-by-name/signed-process-performed-an-unpopular-injection.md">Signed process performed an unpopular injection</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-access-to-shadow-file.md">Suspicious access to shadow file</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-process-execution-from-tmp-folder.md">Suspicious process execution from tmp folder</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-process-execution-in-a-privileged-container.md">Suspicious process execution in a privileged container</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-kernel-module-load.md">Uncommon kernel module load</a></li><li><a href="/analytics-alerts/alerts-by-name/unpopular-rsync-process-execution.md">Unpopular rsync process execution</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-db-process-spawning-a-shell.md">Unusual DB process spawning a shell</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-kubernetes-service-account-file-read.md">Unusual Kubernetes service account file read</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-exec-into-a-kubernetes-pod.md">Unusual exec into a Kubernetes Pod</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-process-accessed-a-macos-notes-db-file.md">Unusual process accessed a macOS notes DB file</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-process-accessed-web-browser-cookies.md">Unusual process accessed web browser cookies</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-process-accessed-web-browser-credentials.md">Unusual process accessed web browser credentials</a></li><li><a href="/analytics-alerts/alerts-by-name/vm-detection-attempt-on-linux.md">VM Detection attempt on Linux</a></li></ul> |
| Improved logic of 3 Informational Analytics Alerts   | <ul><li><a href="/analytics-alerts/alerts-by-name/kubernetes-enumeration-activity.md">Kubernetes enumeration activity</a></li><li><a href="/analytics-alerts/alerts-by-name/multiple-discovery-commands-on-a-linux-host-by-the-same-process.md">Multiple discovery commands on a Linux host by the same process</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-access-to-cloud-credential-files.md">Suspicious access to cloud credential files</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Changed metadata of a Medium Analytics BIOC          | <ul><li><a href="/analytics-alerts/alerts-by-name/discovery-of-misconfigured-certificate-templates-using-ldap.md">Discovery of misconfigured certificate templates using LDAP</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| Changed metadata of 2 Low Analytics BIOCs            | <ul><li><a href="/analytics-alerts/alerts-by-name/ldap-search-query-from-an-unpopular-and-unsigned-process.md">LDAP search query from an unpopular and unsigned process</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-ldap-search-query-executed.md">Suspicious LDAP search query executed</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| Changed metadata of a Low Analytics Alert            | <ul><li><a href="/analytics-alerts/alerts-by-name/rare-ldap-enumeration.md">Rare LDAP enumeration</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Changed metadata of 6 Informational Analytics BIOCs  | <ul><li><a href="/analytics-alerts/alerts-by-name/a-suspicious-process-queried-ad-cs-objects-via-ldap.md">A suspicious process queried AD CS objects via LDAP</a></li><li><a href="/analytics-alerts/alerts-by-name/a-user-queried-ad-cs-objects-via-ldap.md">A user queried AD CS objects via LDAP</a></li><li><a href="/analytics-alerts/alerts-by-name/administrator-groups-enumerated-via-ldap.md">Administrator groups enumerated via LDAP</a></li><li><a href="/analytics-alerts/alerts-by-name/possible-gpo-enumeration.md">Possible GPO Enumeration</a></li><li><a href="/analytics-alerts/alerts-by-name/possible-ldap-enumeration-tool-usage.md">Possible LDAP Enumeration Tool Usage</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-cloud-identity-impersonation.md">Unusual cloud identity impersonation</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| Changed metadata of 3 Informational Analytics Alerts | <ul><li><a href="/analytics-alerts/alerts-by-name/a-user-executed-multiple-ldap-enumeration-queries.md">A user executed multiple LDAP enumeration queries</a></li><li><a href="/analytics-alerts/alerts-by-name/possible-ldap-enumeration-by-unsigned-process.md">Possible LDAP enumeration by unsigned process</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-reconnaissance-using-ldap.md">Suspicious reconnaissance using LDAP</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2024-07-17.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.