2024.09.25

Release date: 29-October-2024

Change type	Changes
Added 2 new Medium Analytics BIOCs	Cloud snapshot of a database or storage instance was publicly shared Uncommon DLL-sideloading from a logical CD-ROM (ISO) device
Added 17 new Informational Analytics BIOCs	AppleScript process executed with a rare command line Attempted Azure application access from unknown tenant Authentication method was added to Azure account Azure Service principal/Application creation Azure conditional access policy creation or modification Azure mailbox rule creation Azure user creation/deletion Azure user password reset Cloud storage delete protection disabled Credentials were added to Azure application External user invitation to Azure tenant Object versioning was disabled OneDrive file download OneDrive file upload OneDrive folder creation Owner was added to Azure application Rare Remote Service (SVCCTL) RPC activity
Added a new Informational Analytics Alert	SSH brute force attempt
Improved logic of a Low Analytics BIOC	Possible DLL Search Order Hijacking
Improved logic of 3 Low Analytics Alerts	Abnormal ICMP echo (PING) to multiple hosts Abnormal sensitive RPC traffic to multiple hosts Impossible traveler - SSO
Improved logic of 4 Informational Analytics BIOCs	A cloud snapshot was created or modified First SSO access from ASN in organization Possible DLL Side-Loading Rare NTLM Access By User To Host
Improved logic of an Informational Analytics Alert	Possible TGT reuse from different hosts (pass the ticket)
Decreased the severity to Low for a BIOC	WSReset.exe UAC bypass