2024.09.04

Release date: 24-September-2024

Change type	Changes
Added a new Low Analytics BIOC	Unusual process accessed a web browser history file
Added a new Informational Analytics BIOC	Possible webshell file written by a web server process
Added a new Informational Analytics Alert	Download pattern that resembles Peer to Peer traffic
Improved logic of a Medium Analytics BIOC	Azure AD PIM alert disabled
Improved logic of a Medium Analytics Alert	Kerberos User Enumeration
Improved logic of 12 Low Analytics BIOCs	Azure AD PIM role settings change Azure account deletion by a non-standard account Azure domain federation settings modification attempt Cloud Trail logging deletion Conditional Access policy removed First Azure AD PowerShell operation for a user MFA was disabled for an Azure identity Uncommon SSH session was established Uncommon creation or access operation of sensitive shadow copy Unusual process accessed FTP Client credentials Unusual process accessed a crypto wallet's files Unusual process accessed a messaging app's files
Improved logic of 3 Low Analytics Alerts	Interactive local account enumeration Kerberos Pre-Auth Failures by Host Multiple Azure AD admin role removals
Improved logic of 33 Informational Analytics BIOCs	A Service Principal was removed from Azure A cloud identity executed an API call from an unusual country A user logged in from an abnormal country or ASN Administrator groups enumerated via LDAP An operation was performed by an identity from a domain that was not seen in the organization Authentication method added to an Azure account Azure AD PIM elevation request Azure AD account unlock/password reset attempt Azure Temporary Access Pass (TAP) registered to an account Azure account creation by a non-standard account Azure application URI modification Azure application consent Azure application credentials added Azure device code authentication flow used Azure service principal assigned app role BitLocker key retrieval Device Registration Policy modification Globally uncommon process execution from a signed process Identity assigned an Azure AD Administrator Role Owner added to Azure application PIM privilege member removal Possible LDAP Enumeration Tool Usage Rare process accessed a Keychain file Removal of an Azure Owner from an Application or Service Principal Successful unusual guest user invitation Suspicious SSO authentication Uncommon net group or localgroup execution Unusual Conditional Access operation for an identity Unusual process accessed a macOS notes DB file Unusual process accessed web browser cookies Unusual process accessed web browser credentials Unverified domain added to Azure AD User attempted to connect from a suspicious country
Improved logic of 6 Informational Analytics Alerts	A user executed multiple LDAP enumeration queries Intense SSO failures Remote account enumeration SSO Password Spray Short-lived Azure AD user account Upload pattern that resembles Peer to Peer traffic