2024.08.28

Release date: 11-September-2024

Change type	Changes
Added 4 new Low Analytics BIOCs	New FTP Server Suspicious SSH Downgrade Unusual process accessed a crypto wallet's files Unusual process accessed a messaging app's files
Added a new Informational Analytics BIOC	Kubernetes Pod Created with host Inter Process Communications (IPC) namespace
Added a new Informational Analytics Alert	Rare access to known advertising domains
Improved logic of a Medium Analytics BIOC	Executable created to disk by lsass.exe
Improved logic of a Medium Analytics Alert	DNS Tunneling
Improved logic of 2 Low Analytics BIOCs	A rare FTP user has been detected on an existing FTP server Unusual process accessed FTP Client credentials
Improved logic of 3 Low Analytics Alerts	Abnormal ICMP echo (PING) to multiple hosts Abnormal sensitive RPC traffic to multiple hosts Spam Bot Traffic
Improved logic of 17 Informational Analytics BIOCs	A cloud identity executed an API call from an unusual country A compute-attached identity executed API calls outside the instance's region Abnormal Communication to a Rare Domain Abnormal Recurring Communications to a Rare Domain An uncommon file added to startup-related Registry keys Execution of an uncommon process at an early startup stage Execution of an uncommon process with a local/domain user SID at an early startup stage Kubernetes Pod Created With Sensitive Volume Kubernetes Pod created with host process ID (PID) namespace Kubernetes Privileged Pod Creation Kubernetes pod creation with host network Rare process accessed a Keychain file Uncommon net group or localgroup execution Unusual Kubernetes service account file read Unusual process accessed a macOS notes DB file Unusual process accessed web browser cookies Unusual process accessed web browser credentials
Improved logic of an Informational Analytics Alert	Port Scan
Decreased the severity to Informational for an Analytics BIOC	Cloud email service activity
Decreased the severity to Informational for an Analytics Alert	Possible TGT reuse from different hosts (pass the ticket)