2025.05.28

Release date: 10-June-2025

Change type	Changes
Added a new Low Analytics BIOC	Rare process created an SSH session to an uncommon cloud resource
Added 2 new Informational Analytics BIOCs	A process connected to a rare cloud resource Uncommon remote shell command execution
Improved logic of a High Analytics Alert	Possible brute force or configuration change attempt on cytool
Improved logic of 10 Low Analytics BIOCs	AURL - An email was sent from a malicious domain Azure AD PIM role settings change Billing admin role was removed EMAIL BETA - Email was received from an unknown sender using a disposable domain EMAIL BETA - External email display name impersonation of internal personnel EMAIL BETA - Unusual hostname for the sending mail server in the email headers EMAIL BETA - Usage of homograph characters detected in an email's from header NTDS.dit file written by an uncommon executable Possible DCSync from a non domain controller Potential SCCM credential harvesting using WMI detected
Improved logic of 2 Low Analytics Alerts	EMAIL BETA - Risk indicators detected in email Logs were not collected from a data source for an abnormally long time
Improved logic of 35 Informational Analytics BIOCs	A cloud identity invoked IAM related persistence operations A user modified an Okta policy rule AURL - Email contains URL(s) classified as inappropriate AURL - Email contains URL(s) classified as malicious AURL - Email was received from a newly registered domain AURL - Email was sent from a domain classified as inappropriate AURL - Unpopular domain(s) detected in an email's URL(s) Activity in a dormant region of a cloud project An AWS Lambda function was modified An Azure Firewall rule collection group was modified or deleted An Azure Suppression Rule was created EMAIL BETA - Email Punycode characters in URL(s) EMAIL BETA - Email attachment with a potentially malicious file extension EMAIL BETA - Email attachment with multiple extensions EMAIL BETA - Email attachment(s) with potentially malicious MIME type EMAIL BETA - Email containing a link with an IP address convention was detected EMAIL BETA - Email containing a redirected link EMAIL BETA - Email has a short body or subject and was sent from an external source EMAIL BETA - Email marked as spam and bulk based on Spam Confidence Level and Bulk Complaint Level values EMAIL BETA - Email mimics replies or forwards without an actual ongoing conversation EMAIL BETA - Email suspicious Moniker link detected EMAIL BETA - Email was received from an unknown address using a public provider domain EMAIL BETA - Email was received from an unknown sender using a recognized domain EMAIL BETA - Email with URL shortener detected EMAIL BETA - Rarely seen URL(s) within a well-known domain detected in your organization's email EMAIL BETA - Suspicious Unicode character detected in email EMAIL BETA - Unpopular URL domain(s) in your organization detected in email EMAIL BETA - Unpopular URL(s) detected in email EMAIL BETA - Unpopular domains detected in email URLs for a recipient EMAIL BETA - Usage of homograph characters detected in an email EMAIL BETA - X-Forefront-Antispam-Report has flagged this email as a potential threat Okta admin privilege assignment Uncommon macOS shell command execution Uncommon shell command execution User attempted to connect from a suspicious country
Improved logic of 2 Informational Analytics Alerts	EMAIL BETA - Suspicious theme and sentiment in email Multiple Okta MFA requests sent to a user
Removed 2 old Informational Analytics BIOCs	An Azure Cloud Shell was Created EMAIL BETA - Email message contains text hiding attributes