2024.07.31

Release date: 13-August-2024

Change type	Changes
Added a new Medium Analytics Alert	Possible Kerberoasting attack
Added 4 new Informational Analytics BIOCs	Abnormal Communication to a Rare Domain Abnormal Recurring Communications to a Rare Domain DLP sensitive data exposed to external users Possible SPN enumeration
Added a new Informational Analytics Alert	Internal Login Password Spray
Improved logic of 2 Medium Analytics BIOCs	Kerberos Traffic from Non-Standard Process Possible code downloading from a remote host by Regsvr32
Improved logic of 9 Low Analytics BIOCs	Non-browser access to a pastebin-like site Possible Kerberoasting without SPNs Rare RDP session to a remote host Rare SMB session to a remote host Recurring access to rare IP Remote usage of an Azure Managed Identity token Scripting engine connected to a rare external host Suspicious SMB connection from domain controller Weakly-Encrypted Kerberos Ticket Requested
Improved logic of 7 Low Analytics Alerts	A user sent multiple TGT requests to irregular service Abnormal SMB activity to multiple hosts Abnormal sensitive RPC traffic to multiple hosts Failed DNS Impossible traveler - SSO Impossible traveler - VPN Multiple Weakly-Encrypted Kerberos Tickets Received
Improved logic of 7 Informational Analytics BIOCs	Cloud Unusual Instance Metadata Service (IMDS) access File transfer from unusual IP using known tools Possible LDAP Enumeration Tool Usage Rare AppID usage to a rare destination Rare DCOM RPC activity Rare Scheduled Task RPC activity Rare connection to external IP address or host by an application using RMI-IIOP or LDAP protocol
Improved logic of 4 Informational Analytics Alerts	A user executed multiple LDAP enumeration queries A user received multiple weakly encrypted service tickets A user requested multiple service tickets Multiple TGT requests for users without Kerberos pre-authentication
Changed metadata of 2 Low Analytics BIOCs	Attempt to execute a command on a remote host using PsExec.exe Unusual process accessed FTP Client credentials
Changed metadata of 5 Informational Analytics BIOCs	Rare process accessed a Keychain file Unusual process accessed a macOS notes DB file Unusual process accessed web browser cookies Unusual process accessed web browser credentials VPN access with an abnormal operating system