2025.03.05

Release date: 27-March-2025

Change type	Changes
Added 2 new Low Analytics BIOCs	Abnormal communication with a rare combination of TLS and HTTP User Agent Uncommon file access over WebDAV
Added 4 new Informational Analytics BIOCs	AWS Transfer Family server created Deletion of AD CS certificate database entries Possible LDAP Enumeration of Microsoft Configuration Manager Rare MS-Update traffic over HTTP
Improved logic of 2 Medium Analytics BIOCs	Suspicious print processor registered Suspicious usage of EC2 token
Improved logic of 4 Low Analytics BIOCs	A Command Line Interface (CLI) command was executed from a GCP serverless compute service AURL - An email was sent from a malicious domain AURL - Email contains URL(s) classified as inappropriate AURL - Email was sent from a domain classified as inappropriate
Improved logic of a Low Analytics Alert	Logs were not collected from a data source for an abnormally long time
Improved logic of 5 Informational Analytics BIOCs	AURL - An email was received from a domain classified as risky AURL - Email contains URL(s) classified as malicious AURL - Email was received from a newly registered domain AURL - URL(s) classified as risky have been detected within Email AURL - Unpopular domain(s) detected in an email's URL(s)
Changed metadata of a Low Analytics BIOC	Remote usage of an Azure Managed Identity token
Changed metadata of an Informational Analytics BIOC	A cloud snapshot was created or modified
Removed 2 old Informational Analytics BIOCs	EMAIL BETA - Email containing financial content was received from an external domain EMAIL BETA - Email containing urgency terms was received from an external domain