2024.12.25

Release date: 19-January-2025

Change type	Changes
Added 2 new Low Analytics BIOCs	NTDS.dit file written by an uncommon executable User set insecure CA registry setting for global SANs
Added 6 new Informational Analytics BIOCs	Access to Kubernetes configuration file Cloud storage automatic backup disabled Privileged role used by Azure application Soft delete of cloud storage configuration was disabled Unusual SSH activity that resembles SSH proxy Unusual user account unlock
Added 4 new Informational Analytics Alerts	Abnormal RDP connections to multiple hosts Azure high-volume data transfer Microsoft OneDrive enumeration activity User accessed multiple O365 AIP sensitive files
Improved logic of a High Analytics BIOC	Collection error
Improved logic of a High Analytics Alert	Suspicious objects encryption in an AWS bucket
Improved logic of 6 Medium Analytics BIOCs	Cloud snapshot of a database or storage instance was publicly shared Commonly abused AutoIT script connects to an external domain Correlation rule error Error in event forwarding Parsing Rule Error Possible new DHCP server
Improved logic of a Medium Analytics Alert	A cloud identity performed multiple unusual activities
Improved logic of 10 Low Analytics BIOCs	A cloud function was created with an unusual runtime Azure AD PIM role settings change Editing ld.so.preload for persistence and injection Login attempt by a honey user Multiple uncommon SSH Servers with the same Server host key Possible DCSync from a non domain controller Remote usage of an Azure Managed Identity token SSO authentication attempt by a honey user Uncommon SSH session was established VPN login attempt by a honey user
Improved logic of 4 Low Analytics Alerts	Failed Connections Large Upload (Generic) Logs were not collected from a data source for an abnormally long time Suspicious identity downloaded multiple objects from a bucket
Improved logic of 8 Informational Analytics BIOCs	A user connected to a VPN from a new country An uncommon file added to startup-related Registry keys LDAP traffic from non-standard process Okta account unlock by admin PsExec was executed with a suspicious command line Rare Remote Service (SVCCTL) RPC activity Rare Scheduled Task RPC activity Unusual Kubernetes service account file read
Improved logic of 3 Informational Analytics Alerts	An identity performed a suspicious download of multiple cloud storage objects Brute-force attempt on a local account SSO Password Spray
Decreased the severity to Low for an Analytics BIOC	Recurring rare domain access from an unsigned process
Decreased the severity to Informational for an Analytics Alert	VPN login Brute-Force attempt
Changed metadata of 109 Informational Analytics BIOCs	A Kubernetes ConfigMap was created or deleted A Kubernetes Cronjob was created A Kubernetes DaemonSet was created A Kubernetes Pod was created with a sidecar container A Kubernetes Pod was deleted A Kubernetes ReplicaSet was created A Kubernetes StatefulSet was created A Kubernetes cluster role binding was created or deleted A Kubernetes cluster was created or deleted A Kubernetes deployment was created A Kubernetes ephemeral container was created A Kubernetes namespace was created or deleted A Kubernetes role binding was created or deleted A Kubernetes secret was created or deleted A Kubernetes service was created or deleted A New Server was Added to an Azure Active Directory Hybrid Health ADFS Environment A Service Principal was created in Azure A Service Principal was removed from Azure A cloud identity invoked IAM related persistence operations A cloud instance was stopped A container registry was created or deleted AWS Cloud Trail log trail modification AWS CloudWatch log group deletion AWS CloudWatch log stream deletion AWS Config Recorder stopped AWS IAM resource group deletion AWS RDS cluster deletion AWS Role Trusted Entity modification AWS Root account activity AWS STS temporary credentials were generated AWS SecurityHub findings were modified AWS config resource deletion AWS network ACL rule creation An AWS EFS File-share mount was deleted An AWS EFS file-share was deleted An AWS EKS cluster was created or deleted An AWS ElastiCache security group was created An AWS ElastiCache security group was modified or deleted An AWS GuardDuty IP set was created An AWS Lambda Function was created An AWS Lambda function was modified An AWS RDS Global Cluster Deletion An AWS RDS instance was created from a snapshot An AWS Route 53 domain was transferred to another AWS account An AWS S3 bucket configuration was modified An AWS SAML provider was modified An AWS SES Email sending settings were modified An AWS SES identity was deleted An Azure Cloud Shell was Created An Azure DNS Zone was modified An Azure Firewall Rule Collection was modified An Azure Firewall was modified An Azure Key Vault key was modified An Azure Key Vault was modified An Azure Kubernetes Cluster was created or deleted An Azure Kubernetes Role or Cluster-Role was modified An Azure Kubernetes Role-Binding or Cluster-Role-Binding was modified or deleted An Azure Kubernetes Service Account was modified or deleted An Azure Network Security Group was modified An Azure Point-to-Site VPN was modified An Azure Suppression Rule was created An Azure VPN Connection was modified An Azure firewall rule group was modified An Azure virtual network Device was modified An Azure virtual network was modified An Email address was added to AWS SES An IAM group was created An identity accessed Azure Kubernetes Secrets An identity was granted permissions to manage user access to Azure resources Aurora DB cluster stopped Azure Automation Runbook Creation/Modification Azure Automation Runbook Deletion Azure Blob Container Access Level Modification Azure Event Hub Authorization rule creation/modification Azure Key Vault Secrets were modified Azure Key Vault modification Azure Kubernetes events were deleted Azure Resource Group Deletion Azure application removed Azure diagnostic configuration deletion Azure permission delegation granted Azure virtual machine commands execution Cloud Organizational policy was created or modified Cloud Trail Logging has been stopped/suspended Cloud identity reached a throttling API rate EC2 snapshot attribute has been modified GCP Firewall Rule Modification GCP Firewall Rule creation GCP IAM Custom Role Creation GCP IAM Role Deletion GCP IAM Service Account Key Deletion GCP Logging Bucket Deletion GCP Logging Sink Modification GCP Pub/Sub Subscription Deletion GCP Pub/Sub Topic Deletion GCP Service Account Disable GCP Service Account key creation GCP Storage Bucket Configuration Modification GCP Virtual Private Cloud (VPC) Network Deletion GCP Virtual Private Network Route Creation GCP Virtual Private Network Route Deletion Granting Access to an Account IAM User added to an IAM group Kubernetes cluster events deletion Kubernetes network policy modification Modification or Deletion of an Azure Application Gateway Detected PIM privilege member removal Removal of an Azure Owner from an Application or Service Principal S3 configuration deletion
Removed an old Informational Analytics BIOC	Process execution with a suspicious command line indicative of the Spring4Shell exploit
Removed an old Informational Analytics Alert	Impossible travel by a cloud identity