2024.10.09

Release date: 11-November-2024

Change type	Changes
Added a new Low Analytics Alert	Logs were not collected from a data source for an abnormally long time
Added 4 new Informational Analytics BIOCs	A user accessed Okta's admin application An Azure application reached a throttling API rate Uncommon cloud CLI tool usage Unusual resource access by Azure application
Added 6 new Informational Analytics Alerts	A user observed and reported unusual activity in Okta An Azure identity performed multiple actions that were denied Azure enumeration activity using Microsoft Graph API Mailbox enumeration activity by Azure application Microsoft SharePoint enumeration activity Microsoft Teams enumeration activity
Improved logic of a High Analytics BIOC	Uncommon remote scheduled task creation
Improved logic of a Medium Analytics BIOC	A Kubernetes API operation was successfully invoked by an anonymous user
Improved logic of a Medium Analytics Alert	DNS Tunneling
Improved logic of 3 Low Analytics BIOCs	Rare SMB session to a remote host Unsigned and unpopular process performed a DLL injection Unsigned and unpopular process performed an injection
Improved logic of 2 Low Analytics Alerts	A user rejected an SSO request from an unusual country Impossible traveler - VPN
Improved logic of 13 Informational Analytics BIOCs	A user connected to a VPN from a new country Authentication method was added to Azure account Cloud Unusual Instance Metadata Service (IMDS) access Exchange email-hiding inbox rule Network traffic to a crypto miner related domain detected Penetration testing tool attempt Rare DCOM RPC activity Rare Remote Service (SVCCTL) RPC activity Rare Scheduled Task RPC activity SSO with abnormal operating system SSO with new operating system Suspicious SSO authentication VPN access with an abnormal operating system
Improved logic of an Informational Analytics Alert	Multiple SSO MFA attempts were rejected by a user
Decreased the severity to Informational for an Analytics BIOC	Process execution with a suspicious command line indicative of the Spring4Shell exploit
Changed metadata of a Low Analytics BIOC	Uncommon SSH session was established
Changed metadata of 2 Informational Analytics BIOCs	Attempted Azure application access from unknown tenant Executable or Script file written by a web server process
Changed metadata of an Informational Analytics Alert	Download pattern that resembles Peer to Peer traffic