2024.11.20

Release date: 03-December-2024

Change type	Changes
Added a new Medium Analytics BIOC	Suspicious Kubernetes pod token access
Added 3 new Low Analytics BIOCs	A process queried the ADFS database decryption key via LDAP Potential SCCM credential harvesting using WMI detected Unusual Encrypting File System Remote call (EFSRPC) to domain controller
Added 8 new Informational Analytics BIOCs	A Service Principal was created in Azure Azure application removed Azure group creation/deletion Azure permission delegation granted Data encryption was disabled Member added to a Windows local security group Okta account unlock by admin Potential Okta access limit breach
Added a new Informational Analytics Alert	Okta account unlock
Improved logic of 2 Medium Analytics BIOCs	Executable moved to Windows system folder Parsing Rule Error
Improved logic of 4 Low Analytics BIOCs	Azure account deletion by a non-standard account Cloud Trail logging deletion Uncommon Remote Monitoring and Management Tool Uncommon SSH session was established
Improved logic of 2 Low Analytics Alerts	Logs were not collected from a data source for an abnormally long time Suspicious identity downloaded multiple objects from a bucket
Improved logic of 16 Informational Analytics BIOCs	A cloud identity created or modified a security group A cloud identity had escalated its permissions A user was added to a Windows security group Activity in a dormant region of a cloud project An identity attached an administrative policy to an IAM user/role An uncommon file added to startup-related Registry keys Browser Extension Installed Cloud compute serial console access Cloud email service activity Execution of an uncommon process at an early startup stage Execution of an uncommon process with a local/domain user SID at an early startup stage GCP set IAM policy activity Suspicious cloud compute instance ssh keys modification attempt Unusual AWS systems manager activity Unusual cloud identity impersonation Unusual resource modification/creation
Improved logic of 3 Informational Analytics Alerts	Multi region enumeration activity Port Scan Storage enumeration activity
Decreased the severity to Low for an Analytics BIOC	Editing ld.so.preload for persistence and injection
Decreased the severity to Informational for 2 Analytics BIOCs	Abnormal Communication to a Rare IP Abnormal Recurring Communications to a Rare IP
Removed an old Informational BIOC	Modification of SSH authorized keys