2025.04.23

Release date: 14-May-2025

Change type	Changes
Added 3 new Informational Analytics BIOCs	A cloud snapshot of AWS database or storage was modified or shared Possible authentication coercion Unusual access to Microsoft 365 storage services
Added a new Informational Analytics Alert	Potential NTLM Relay Attack
Improved logic of a Medium Analytics BIOC	A cloud storage object was copied to a foreign cloud account
Improved logic of 2 Low Analytics BIOCs	LDAP AD CS Enumeration via Attack Tool Possible path traversal via HTTP request
Improved logic of 7 Informational Analytics BIOCs	A process connected to rare external host Access to Kubernetes configuration file EMAIL BETA - Well-known brand impersonation within an email's from address domain Execution of an uncommon process at an early startup stage Execution of an uncommon process with a local/domain user SID at an early startup stage Possible LDAP Enumeration Tool Usage Suspicious MFA request reported by user in Entra ID
Improved logic of 3 Informational Analytics Alerts	A user executed multiple LDAP enumeration queries SSO Password Spray Suspicious access to cloud credential files
Decreased the severity to Informational for 2 Analytics BIOCs	AWS Flow Logs deletion AWS network ACL rule deletion
Changed metadata of a Low Analytics BIOC	A Command Line Interface (CLI) command was executed from a GCP serverless compute service