2025.02.19

Release date: 09-March-2025

Change type	Changes
Added 3 new Informational Analytics BIOCs	Azure audit - MFA fraud reported Uncommon driver loaded Unusual user account enablement
Improved logic of a High Analytics BIOC	Collection error
Improved logic of a Medium Analytics BIOC	Cloud snapshot of a database or storage instance was publicly shared
Improved logic of 7 Low Analytics BIOCs	AWS Flow Logs deletion Azure Event Hub Deletion Cloud Trail logging deletion Possible DCSync from a non domain controller Uncommon local scheduled task creation via schtasks.exe Unusual Encrypting File System Remote call (EFSRPC) to domain controller Unusual cross projects activity
Improved logic of 2 Low Analytics Alerts	An identity dumped multiple secrets from a project Logs were not collected from a data source for an abnormally long time
Improved logic of 44 Informational Analytics BIOCs	A Kubernetes ConfigMap was created or deleted A Kubernetes Cronjob was created A Kubernetes cluster role binding was created or deleted A Kubernetes cluster was created or deleted A Kubernetes ephemeral container was created A Kubernetes namespace was created or deleted A Kubernetes role binding was created or deleted A Kubernetes secret was created or deleted A Kubernetes service account executed an unusual API call A Kubernetes service account was created or deleted A Kubernetes service was created or deleted A cloud identity created or modified a security group A cloud identity executed an API call from an unusual country A cloud identity had escalated its permissions A cloud identity invoked IAM related persistence operations A cloud instance was stopped A cloud snapshot was created or modified A container registry was created or deleted A user modified an Okta network zone Activity in a dormant region of a cloud project An Azure application reached a throttling API rate An identity attached an administrative policy to an IAM user/role Azure application credentials added Azure storage account blob anonymous access is enabled Azure storage account was publicly shared Cloud compute instance user data script modification Cloud compute serial console access Cloud identity reached a throttling API rate Cloud impersonation attempt by unusual identity type Data encryption was disabled Exchange email-hiding inbox rule Kubernetes admission controller activity Kubernetes cluster events deletion Kubernetes network policy modification Network sniffing detected in Cloud environment Possible LDAP Enumeration Tool Usage Rare Remote Service (SVCCTL) RPC activity Rare Scheduled Task RPC activity Unusual AWS systems manager activity Unusual Identity and Access Management (IAM) activity Unusual cloud identity impersonation Unusual resource modification by newly seen IAM user Unusual resource modification/creation User attempted to connect from a suspicious country
Improved logic of 11 Informational Analytics Alerts	A user executed multiple LDAP enumeration queries An identity performed a suspicious download of multiple cloud storage objects Cloud infrastructure enumeration activity Deletion of multiple cloud resources IAM Enumeration sequence Internal Login Password Spray Kubernetes enumeration activity Multi region enumeration activity Multiple failed logins from a single IP SSH brute force attempt Storage enumeration activity
Decreased the severity to Low for an Analytics BIOC	Possible Microsoft process masquerading
Changed metadata of a Medium Analytics BIOC	Suspicious heavy allocation of compute resources - possible mining activity
Changed metadata of a Low Analytics BIOC	Copy a user's GnuPG directory with rsync
Changed metadata of a Low Analytics Alert	Excessive user account lockouts
Changed metadata of an Informational Analytics BIOC	Azure diagnostic configuration deletion
Changed metadata of 3 Informational Analytics Alerts	Abnormal Allocation of compute resources in multiple regions Allocation of multiple cloud compute resources Rare access to known advertising domains