2024.07.24

Release date: 07-August-2024

Change type	Changes
Added a new High Analytics BIOC	Collection error
Added 2 new Medium Analytics BIOCs	Correlation rule error Error in event forwarding
Added 2 new Low Analytics BIOCs	A rare FTP user has been detected on an existing FTP server Cloud email service activity
Added a new Informational Analytics BIOC	Rare DLP rule match by user
Improved logic of a High Analytics BIOC	Copy a process memory file
Improved logic of 4 Medium Analytics BIOCs	Execution of the Hydra Linux password brute-force tool Kubernetes vulnerability scanning tool usage Recurring rare domain access from an unsigned process Windows LOLBIN executable connected to a rare external host
Improved logic of 18 Low Analytics BIOCs	An uncommon service was started Change of sudo caching configuration Compressing data using python Copy a user's GnuPG directory with rsync Installation of a new System-V service Keylogging using system commands Linux system firewall was modified Masquerading as the Linux crond process Possible DLL Hijack into a Microsoft process Possible DLL Search Order Hijacking Rare Windows Remote Management (WinRM) HTTP Activity Setuid and Setgid file bit manipulation Suspicious process modified RC script file Suspicious sshpass command execution Uncommon AT task-job creation by user Uncommon creation or access operation of sensitive shadow copy Unusual compressed file password protection Unusual process accessed FTP Client credentials
Improved logic of 2 Low Analytics Alerts	Impossible traveler - SSO Impossible traveler - VPN
Improved logic of 31 Informational Analytics BIOCs	A cloud storage configuration was modified A compressed file was exfiltrated over SSH Activity in a dormant region of a cloud project Adding execution privileges File transfer from unusual IP using known tools Indicator blocking Kubernetes Pod Created With Sensitive Volume Kubernetes Pod created with host process ID (PID) namespace Kubernetes Privileged Pod Creation Kubernetes pod creation with host network Kubernetes version disclosure Modification of PAM Permission Groups discovery commands Possible DLL Side-Loading Possible LDAP Enumeration Tool Usage Possible data obfuscation Rare process accessed a Keychain file Run downloaded script using pipe Signed process performed an unpopular injection Suspicious access to shadow file Suspicious process execution from tmp folder Suspicious process execution in a privileged container Uncommon kernel module load Unpopular rsync process execution Unusual DB process spawning a shell Unusual Kubernetes service account file read Unusual exec into a Kubernetes Pod Unusual process accessed a macOS notes DB file Unusual process accessed web browser cookies Unusual process accessed web browser credentials VM Detection attempt on Linux
Improved logic of 4 Informational Analytics Alerts	Kubernetes enumeration activity Multiple discovery commands on a Linux host by the same process Sensitive Exchange mail sent to external users Suspicious access to cloud credential files
Decreased the severity to Informational for an Analytics BIOC	A process modified an SSH authorized_keys file
Changed metadata of a Medium Analytics BIOC	Discovery of misconfigured certificate templates using LDAP
Changed metadata of 2 Low Analytics BIOCs	LDAP search query from an unpopular and unsigned process Suspicious LDAP search query executed
Changed metadata of a Low Analytics Alert	Rare LDAP enumeration
Changed metadata of 5 Informational Analytics BIOCs	A suspicious process queried AD CS objects via LDAP A user queried AD CS objects via LDAP Administrator groups enumerated via LDAP Possible GPO Enumeration Unusual cloud identity impersonation
Changed metadata of 3 Informational Analytics Alerts	A user executed multiple LDAP enumeration queries Possible LDAP enumeration by unsigned process Suspicious reconnaissance using LDAP