> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2025-06-04.md).

# 2025.06.04

**Release date: 18-June-2025**

| Change type                                          | Changes                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Added 2 new Informational Analytics BIOCs            | <ul><li><a href="/analytics-alerts/alerts-by-name/potential-dcsync-by-an-unusual-user.md">Potential DCSync by an unusual user</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-access-to-cloud-platforms-sensitive-files-by-a-scripting-engine.md">Uncommon access to cloud platforms' sensitive files by a scripting engine</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| Improved logic of 7 High Analytics BIOCs             | <ul><li><a href="/analytics-alerts/alerts-by-name/copy-a-process-memory-file.md">Copy a process memory file</a></li><li><a href="/analytics-alerts/alerts-by-name/memory-dumping-with-comsvcs-dll.md">Memory dumping with comsvcs.dll</a></li><li><a href="/analytics-alerts/alerts-by-name/mimikatz-command-line-arguments.md">Mimikatz command-line arguments</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-usage-of-file-server-remote-vss-protocol-fsrvp.md">Suspicious usage of File Server Remote VSS Protocol (FSRVP)</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-remote-scheduled-task-creation.md">Uncommon remote scheduled task creation</a></li><li><a href="/analytics-alerts/alerts-by-name/unicode-rtl-override-character.md">Unicode RTL Override Character</a></li><li><a href="/analytics-alerts/alerts-by-name/unprivileged-process-opened-a-registry-hive.md">Unprivileged process opened a registry hive</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
| Improved logic of 35 Medium Analytics BIOCs          | <ul><li><a href="/analytics-alerts/alerts-by-name/a-tcp-stream-was-created-directly-in-a-shell.md">A TCP stream was created directly in a shell</a></li><li><a href="/analytics-alerts/alerts-by-name/a-process-was-executed-with-a-command-line-obfuscated-by-unicode-character-substitution.md">A process was executed with a command line obfuscated by Unicode character substitution</a></li><li><a href="/analytics-alerts/alerts-by-name/autorun-inf-created-in-root-c-drive.md">Autorun.inf created in root C drive</a></li><li><a href="/analytics-alerts/alerts-by-name/commonly-abused-autoit-script-connects-to-an-external-domain.md">Commonly abused AutoIT script connects to an external domain</a></li><li><a href="/analytics-alerts/alerts-by-name/encoded-information-using-windows-certificate-management-tool.md">Encoded information using Windows certificate management tool</a></li><li><a href="/analytics-alerts/alerts-by-name/executable-created-to-disk-by-lsass-exe.md">Executable created to disk by lsass.exe</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Execution of the Hydra Linux password brute-force tool</a></li><li><a href="/analytics-alerts/alerts-by-name/fodhelper-exe-uac-bypass.md">Fodhelper.exe UAC bypass</a></li><li><a href="/analytics-alerts/alerts-by-name/indirect-command-execution-using-the-program-compatibility-assistant.md">Indirect command execution using the Program Compatibility Assistant</a></li><li><a href="/analytics-alerts/alerts-by-name/interactive-at-exe-privilege-escalation-method.md">Interactive at.exe privilege escalation method</a></li><li><a href="/analytics-alerts/alerts-by-name/kerberos-traffic-from-non-standard-process.md">Kerberos Traffic from Non-Standard Process</a></li><li><a href="/analytics-alerts/alerts-by-name/lsass-dump-file-written-to-disk.md">LSASS dump file written to disk</a></li><li><a href="/analytics-alerts/alerts-by-name/microsoft-office-process-spawning-a-suspicious-one-liner.md">Microsoft Office Process Spawning a Suspicious One-Liner</a></li><li><a href="/analytics-alerts/alerts-by-name/modification-of-ntlm-restrictions-in-the-registry.md">Modification of NTLM restrictions in the Registry</a></li><li><a href="/analytics-alerts/alerts-by-name/phantom-dll-loading.md">Phantom DLL Loading</a></li><li><a href="/analytics-alerts/alerts-by-name/possible-persistence-via-group-policy-registry-keys.md">Possible Persistence via group policy Registry keys</a></li><li><a href="/analytics-alerts/alerts-by-name/possible-rdp-session-hijacking-using-tscon-exe.md">Possible RDP session hijacking using tscon.exe</a></li><li><a href="/analytics-alerts/alerts-by-name/possible-code-downloading-from-a-remote-host-by-regsvr32.md">Possible code downloading from a remote host by Regsvr32</a></li><li><a href="/analytics-alerts/alerts-by-name/possible-collection-of-screen-captures-with-windows-problem-steps-recorder.md">Possible collection of screen captures with Windows Problem Steps Recorder</a></li><li><a href="/analytics-alerts/alerts-by-name/possible-malicious-net-compilation-started-by-a-commonly-abused-process.md">Possible malicious .NET compilation started by a commonly abused process</a></li><li><a href="/analytics-alerts/alerts-by-name/powershell-runs-suspicious-base64-encoded-commands.md">PowerShell runs suspicious base64-encoded commands</a></li><li><a href="/analytics-alerts/alerts-by-name/powershell-suspicious-flags.md">PowerShell suspicious flags</a></li><li><a href="/analytics-alerts/alerts-by-name/procdump-executed-from-an-atypical-directory.md">Procdump executed from an atypical directory</a></li><li><a href="/analytics-alerts/alerts-by-name/remote-wmi-process-execution.md">Remote WMI process execution</a></li><li><a href="/analytics-alerts/alerts-by-name/rundll32-exe-running-with-no-command-line-arguments.md">Rundll32.exe running with no command-line arguments</a></li><li><a href="/analytics-alerts/alerts-by-name/rundll32-exe-spawns-conhost-exe.md">Rundll32.exe spawns conhost.exe</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-net-process-loads-an-msbuild-dll.md">Suspicious .NET process loads an MSBuild DLL</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-powersploit-s-recon-module-powerview-net-function-was-executed.md">Suspicious PowerSploit's recon module (PowerView) net function was executed</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-powersploit-s-recon-module-powerview-used-to-search-for-exposed-hosts.md">Suspicious PowerSploit's recon module (PowerView) used to search for exposed hosts</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-certutil-command-line.md">Suspicious certutil command line</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-dll-sideloading-from-a-logical-cd-rom-iso-device.md">Uncommon DLL-sideloading from a logical CD-ROM (ISO) device</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-setwindowshookex-api-invocation-of-a-possible-keylogger.md">Uncommon SetWindowsHookEx API invocation of a possible keylogger</a></li><li><a href="/analytics-alerts/alerts-by-name/unsigned-process-injecting-into-a-windows-system-binary-with-no-command-line.md">Unsigned process injecting into a Windows system binary with no command line</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-process-access-to-ld-so-preload-file.md">Unusual process access to ld.so.preload file</a></li><li><a href="/analytics-alerts/alerts-by-name/windows-lolbin-executable-connected-to-a-rare-external-host.md">Windows LOLBIN executable connected to a rare external host</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| Improved logic of 101 Low Analytics BIOCs            | <ul><li><a href="/analytics-alerts/alerts-by-name/a-process-queried-the-adfs-database-decryption-key-via-ldap.md">A process queried the ADFS database decryption key via LDAP</a></li><li><a href="/analytics-alerts/alerts-by-name/a-remote-service-was-created-via-rpc-over-smb.md">A remote service was created via RPC over SMB</a></li><li><a href="/analytics-alerts/alerts-by-name/a-suspicious-direct-syscall-was-executed.md">A suspicious direct syscall was executed</a></li><li><a href="/analytics-alerts/alerts-by-name/a-suspicious-process-enrolled-for-a-certificate.md">A suspicious process enrolled for a certificate</a></li><li><a href="/analytics-alerts/alerts-by-name/an-uncommon-service-was-started.md">An uncommon service was started</a></li><li><a href="/analytics-alerts/alerts-by-name/an-unpopular-process-accessed-the-microphone-on-the-host.md">An unpopular process accessed the microphone on the host</a></li><li><a href="/analytics-alerts/alerts-by-name/attempt-to-execute-a-command-on-a-remote-host-using-psexec-exe.md">Attempt to execute a command on a remote host using PsExec.exe</a></li><li><a href="/analytics-alerts/alerts-by-name/cached-credentials-discovery-with-cmdkey.md">Cached credentials discovery with cmdkey</a></li><li><a href="/analytics-alerts/alerts-by-name/change-of-sudo-caching-configuration.md">Change of sudo caching configuration</a></li><li><a href="/analytics-alerts/alerts-by-name/compressing-data-using-python.md">Compressing data using python</a></li><li><a href="/analytics-alerts/alerts-by-name/conhost-exe-spawned-a-suspicious-cmd-process.md">Conhost.exe spawned a suspicious cmd process</a></li><li><a href="/analytics-alerts/alerts-by-name/copy-a-user-s-gnupg-directory-with-rsync.md">Copy a user's GnuPG directory with rsync</a></li><li><a href="/analytics-alerts/alerts-by-name/download-a-script-using-the-python-requests-module.md">Download a script using the python requests module</a></li><li><a href="/analytics-alerts/alerts-by-name/elevation-to-system-via-services.md">Elevation to SYSTEM via services</a></li><li><a href="/analytics-alerts/alerts-by-name/executable-or-script-file-written-by-a-web-server-process.md">Executable or Script file written by a web server process</a></li><li><a href="/analytics-alerts/alerts-by-name/execution-of-an-uncommon-process-at-an-early-startup-stage-by-windows-system-binary.md">Execution of an uncommon process at an early startup stage by Windows system binary</a></li><li><a href="https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/execution-of-an-uncommon-process-with-a-local-domain-user-sid-at-an-early-startup-stage-by-windows-system-binary">Execution of an uncommon process with a local/domain user SID at an early startup stage by Windows system binary</a></li><li><a href="/analytics-alerts/alerts-by-name/execution-of-dllhost-exe-with-an-empty-command-line.md">Execution of dllhost.exe with an empty command line</a></li><li><a href="/analytics-alerts/alerts-by-name/execution-of-renamed-lolbin.md">Execution of renamed lolbin</a></li><li><a href="/analytics-alerts/alerts-by-name/extracting-credentials-from-unix-files.md">Extracting credentials from Unix files</a></li><li><a href="/analytics-alerts/alerts-by-name/globally-uncommon-root-domain-from-a-signed-process.md">Globally uncommon root domain from a signed process</a></li><li><a href="/analytics-alerts/alerts-by-name/globally-uncommon-root-domain-port-combination-from-a-signed-process.md">Globally uncommon root-domain port combination from a signed process</a></li><li><a href="/analytics-alerts/alerts-by-name/image-file-execution-options-ifeo-registry-key-set.md">Image file execution options (IFEO) registry key set</a></li><li><a href="/analytics-alerts/alerts-by-name/installation-of-a-new-system-v-service.md">Installation of a new System-V service</a></li><li><a href="/analytics-alerts/alerts-by-name/keylogging-using-system-commands.md">Keylogging using system commands</a></li><li><a href="/analytics-alerts/alerts-by-name/known-service-display-name-with-uncommon-image-path.md">Known service display name with uncommon image-path</a></li><li><a href="/analytics-alerts/alerts-by-name/known-service-name-with-an-uncommon-image-path.md">Known service name with an uncommon image-path</a></li><li><a href="/analytics-alerts/alerts-by-name/lolbin-process-executed-with-a-high-integrity-level.md">LOLBIN process executed with a high integrity level</a></li><li><a href="/analytics-alerts/alerts-by-name/linux-system-firewall-was-modified.md">Linux system firewall was modified</a></li><li><a href="/analytics-alerts/alerts-by-name/masquerading-as-the-linux-crond-process.md">Masquerading as the Linux crond process</a></li><li><a href="/analytics-alerts/alerts-by-name/microsoft-office-adds-a-value-to-autostart-registry-key.md">Microsoft Office adds a value to autostart Registry key</a></li><li><a href="/analytics-alerts/alerts-by-name/microsoft-office-injects-code-into-a-process.md">Microsoft Office injects code into a process</a></li><li><a href="/analytics-alerts/alerts-by-name/microsoft-office-process-spawns-a-commonly-abused-process.md">Microsoft Office process spawns a commonly abused process</a></li><li><a href="/analytics-alerts/alerts-by-name/ntds-dit-file-written-by-an-uncommon-executable.md">NTDS.dit file written by an uncommon executable</a></li><li><a href="/analytics-alerts/alerts-by-name/new-addition-to-windows-defender-exclusion-list.md">New addition to Windows Defender exclusion list</a></li><li><a href="/analytics-alerts/alerts-by-name/office-process-accessed-an-unusual-lnk-file.md">Office process accessed an unusual .LNK file</a></li><li><a href="/analytics-alerts/alerts-by-name/possible-dll-hijack-into-a-microsoft-process.md">Possible DLL Hijack into a Microsoft process</a></li><li><a href="/analytics-alerts/alerts-by-name/possible-dll-search-order-hijacking.md">Possible DLL Search Order Hijacking</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Possible Microsoft process masquerading</a></li><li><a href="/analytics-alerts/alerts-by-name/possible-network-sniffing-attempt-via-tcpdump-or-tshark.md">Possible network sniffing attempt via tcpdump or tshark</a></li><li><a href="/analytics-alerts/alerts-by-name/possible-webshell-file-written-by-a-web-server-process.md">Possible webshell file written by a web server process</a></li><li><a href="/analytics-alerts/alerts-by-name/potential-sccm-credential-harvesting-using-wmi-detected.md">Potential SCCM credential harvesting using WMI detected</a></li><li><a href="/analytics-alerts/alerts-by-name/rdp-connections-enabled-remotely-via-registry.md">RDP connections enabled remotely via Registry</a></li><li><a href="/analytics-alerts/alerts-by-name/rare-process-created-an-ssh-session-to-an-uncommon-cloud-resource.md">Rare process created an SSH session to an uncommon cloud resource</a></li><li><a href="/analytics-alerts/alerts-by-name/rare-process-created-an-ssh-session-to-an-uncommon-external-host.md">Rare process created an SSH session to an uncommon external host</a></li><li><a href="/analytics-alerts/alerts-by-name/rare-process-executed-by-an-applescript.md">Rare process executed by an AppleScript</a></li><li><a href="/analytics-alerts/alerts-by-name/rare-process-with-vnc-server-capabilities-started.md">Rare process with VNC server capabilities started</a></li><li><a href="/analytics-alerts/alerts-by-name/rare-scheduled-task-created.md">Rare scheduled task created</a></li><li><a href="/analytics-alerts/alerts-by-name/rare-service-dll-was-added-to-the-registry.md">Rare service DLL was added to the registry</a></li><li><a href="/analytics-alerts/alerts-by-name/reading-bash-command-history-file.md">Reading bash command history file</a></li><li><a href="/analytics-alerts/alerts-by-name/recurring-rare-domain-access-from-an-unsigned-process.md">Recurring rare domain access from an unsigned process</a></li><li><a href="/analytics-alerts/alerts-by-name/remote-dcom-command-execution.md">Remote DCOM command execution</a></li><li><a href="/analytics-alerts/alerts-by-name/remote-command-execution-via-wmic-exe.md">Remote command execution via wmic.exe</a></li><li><a href="/analytics-alerts/alerts-by-name/remote-service-start-from-an-uncommon-source.md">Remote service start from an uncommon source</a></li><li><a href="/analytics-alerts/alerts-by-name/rundll32-exe-executes-a-rare-unsigned-module.md">Rundll32.exe executes a rare unsigned module</a></li><li><a href="/analytics-alerts/alerts-by-name/suid-guid-permission-discovery.md">SUID/GUID permission discovery</a></li><li><a href="/analytics-alerts/alerts-by-name/scheduled-task-hidden-by-registry-modification.md">Scheduled Task hidden by registry modification</a></li><li><a href="/analytics-alerts/alerts-by-name/screensaver-process-executed-from-users-or-temporary-folder.md">Screensaver process executed from Users or temporary folder</a></li><li><a href="/analytics-alerts/alerts-by-name/scripting-engine-connected-to-a-rare-external-host.md">Scripting engine connected to a rare external host</a></li><li><a href="/analytics-alerts/alerts-by-name/sensitive-browser-credential-files-accessed-by-a-rare-non-browser-process.md">Sensitive browser credential files accessed by a rare non browser process</a></li><li><a href="/analytics-alerts/alerts-by-name/setuid-and-setgid-file-bit-manipulation.md">Setuid and Setgid file bit manipulation</a></li><li><a href="/analytics-alerts/alerts-by-name/stored-credentials-exported-using-credwiz-exe.md">Stored credentials exported using credwiz.exe</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-certutil-ad-cs-contact.md">Suspicious Certutil AD CS contact</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-dotnet-log-file-created.md">Suspicious DotNet log file created</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-print-system-remote-protocol-usage-by-a-process.md">Suspicious Print System Remote Protocol usage by a process</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-udev-driver-rule-execution-manipulation.md">Suspicious Udev driver rule execution manipulation</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-container-orchestration-job.md">Suspicious container orchestration job</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-data-encryption.md">Suspicious data encryption</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-disablement-of-the-windows-firewall.md">Suspicious disablement of the Windows Firewall</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-module-load-using-direct-syscall.md">Suspicious module load using direct syscall</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-process-accessed-certificate-files.md">Suspicious process accessed certificate files</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-process-modified-rc-script-file.md">Suspicious process modified RC script file</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-sshpass-command-execution.md">Suspicious sshpass command execution</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-systemd-timer-activity.md">Suspicious systemd timer activity</a></li><li><a href="/analytics-alerts/alerts-by-name/svchost-exe-loads-a-rare-unsigned-module.md">Svchost.exe loads a rare unsigned module</a></li><li><a href="/analytics-alerts/alerts-by-name/the-linux-system-firewall-was-disabled.md">The Linux system firewall was disabled</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-at-task-job-creation-by-user.md">Uncommon AT task-job creation by user</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-ntwritevirtualmemoryremote-api-invocation-with-a-pe-header-buffer.md">Uncommon NtWriteVirtualMemoryRemote API invocation with a PE header buffer</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-powershell-commands-used-to-create-or-alter-scheduled-task-parameters.md">Uncommon PowerShell commands used to create or alter scheduled task parameters</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-access-to-microsoft-teams-credential-files.md">Uncommon access to Microsoft Teams credential files</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-creation-or-access-operation-of-sensitive-shadow-copy.md">Uncommon creation or access operation of sensitive shadow copy</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-execution-of-odbcconf.md">Uncommon execution of ODBCConf</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-local-scheduled-task-creation-via-schtasks-exe.md">Uncommon local scheduled task creation via schtasks.exe</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-msiexec-execution-of-an-arbitrary-file-from-a-remote-location.md">Uncommon msiexec execution of an arbitrary file from a remote location</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-remote-monitoring-and-management-tool.md">Uncommon remote monitoring and management tool</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-reverse-ssh-tunnel-to-external-domain-ip.md">Uncommon reverse SSH tunnel to external domain/ip</a></li><li><a href="/analytics-alerts/alerts-by-name/unsigned-process-creates-a-scheduled-task-via-file-access.md">Unsigned process creates a scheduled task via file access</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-aws-credentials-creation.md">Unusual AWS credentials creation</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-aws-user-added-to-group.md">Unusual AWS user added to group</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-azure-ad-sync-module-load.md">Unusual Azure AD sync module load</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-cim-repository-file-access.md">Unusual CIM repository file access</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-compressed-file-password-protection.md">Unusual compressed file password protection</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-process-accessed-ftp-client-credentials.md">Unusual process accessed FTP Client credentials</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-process-accessed-a-crypto-wallet-s-files.md">Unusual process accessed a crypto wallet's files</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-process-accessed-a-messaging-app-s-files.md">Unusual process accessed a messaging app's files</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-process-accessed-a-web-browser-history-file.md">Unusual process accessed a web browser history file</a></li><li><a href="/analytics-alerts/alerts-by-name/usage-of-homograph-characters-detected-in-an-email-s-from-header.md">Usage of homograph characters detected in an email's from header</a></li><li><a href="/analytics-alerts/alerts-by-name/windows-event-log-was-cleared-using-wevtutil-exe.md">Windows Event Log was cleared using wevtutil.exe</a></li><li><a href="/analytics-alerts/alerts-by-name/windows-event-logs-were-cleared-with-powershell.md">Windows event logs were cleared with PowerShell</a></li><li><a href="/analytics-alerts/alerts-by-name/wmiprvse-exe-rare-child-command-line.md">WmiPrvSe.exe Rare Child Command Line</a></li><li><a href="/analytics-alerts/alerts-by-name/wsmprovhost-exe-rare-child-process.md">Wsmprovhost.exe Rare Child Process</a></li></ul> |
| Improved logic of 5 Low Analytics Alerts             | <ul><li><a href="/analytics-alerts/alerts-by-name/failed-connections.md">Failed Connections</a></li><li><a href="/analytics-alerts/alerts-by-name/multiple-rare-lolbin-process-executions-by-user.md">Multiple Rare LOLBIN Process Executions by User</a></li><li><a href="/analytics-alerts/alerts-by-name/multiple-discovery-commands.md">Multiple discovery commands</a></li><li><a href="/analytics-alerts/alerts-by-name/multiple-discovery-commands-on-a-windows-host-by-the-same-process.md">Multiple discovery commands on a Windows host by the same process</a></li><li><a href="/analytics-alerts/alerts-by-name/outlook-files-accessed-by-an-unsigned-process.md">Outlook files accessed by an unsigned process</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| Improved logic of 90 Informational Analytics BIOCs   | <ul><li><a href="/analytics-alerts/alerts-by-name/a-lolbin-was-copied-to-a-different-location.md">A LOLBIN was copied to a different location</a></li><li><a href="/analytics-alerts/alerts-by-name/a-browser-extension-was-installed-or-loaded-in-an-uncommon-way.md">A browser extension was installed or loaded in an uncommon way</a></li><li><a href="/analytics-alerts/alerts-by-name/a-cloud-identity-invoked-iam-related-persistence-operations.md">A cloud identity invoked IAM related persistence operations</a></li><li><a href="/analytics-alerts/alerts-by-name/a-compressed-file-was-exfiltrated-over-ssh.md">A compressed file was exfiltrated over SSH</a></li><li><a href="/analytics-alerts/alerts-by-name/a-non-browser-process-accessed-a-website-ui.md">A non-browser process accessed a website UI</a></li><li><a href="/analytics-alerts/alerts-by-name/a-process-connected-to-a-rare-cloud-resource.md">A process connected to a rare cloud resource</a></li><li><a href="/analytics-alerts/alerts-by-name/a-process-connected-to-a-rare-external-host.md">A process connected to a rare external host</a></li><li><a href="/analytics-alerts/alerts-by-name/a-process-connected-to-rare-external-host.md">A process connected to rare external host</a></li><li><a href="/analytics-alerts/alerts-by-name/a-process-modified-an-ssh-authorized-keys-file.md">A process modified an SSH authorized\_keys file</a></li><li><a href="/analytics-alerts/alerts-by-name/a-service-was-disabled.md">A service was disabled</a></li><li><a href="/analytics-alerts/alerts-by-name/access-to-kubernetes-configuration-file.md">Access to Kubernetes configuration file</a></li><li><a href="/analytics-alerts/alerts-by-name/adding-execution-privileges.md">Adding execution privileges</a></li><li><a href="/analytics-alerts/alerts-by-name/an-uncommon-file-added-to-startup-related-registry-keys.md">An uncommon file added to startup-related Registry keys</a></li><li><a href="/analytics-alerts/alerts-by-name/an-uncommon-file-was-created-in-the-startup-folder.md">An uncommon file was created in the startup folder</a></li><li><a href="/analytics-alerts/alerts-by-name/applescript-executed-a-shell-script.md">AppleScript executed a shell script</a></li><li><a href="/analytics-alerts/alerts-by-name/applescript-process-executed-with-a-rare-command-line.md">AppleScript process executed with a rare command line</a></li><li><a href="/analytics-alerts/alerts-by-name/browser-bookmark-files-accessed-by-a-rare-non-browser-process.md">Browser bookmark files accessed by a rare non-browser process</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Cloud Unusual Instance Metadata Service (IMDS) access</a></li><li><a href="/analytics-alerts/alerts-by-name/command-execution-via-wmiexec.md">Command execution via wmiexec</a></li><li><a href="/analytics-alerts/alerts-by-name/commonly-abused-autoit-script-drops-an-executable-file-to-disk.md">Commonly abused AutoIT script drops an executable file to disk</a></li><li><a href="/analytics-alerts/alerts-by-name/creation-or-modification-of-the-default-command-executed-when-opening-an-application.md">Creation or modification of the default command executed when opening an application</a></li><li><a href="/analytics-alerts/alerts-by-name/discovery-of-host-users-via-wmic.md">Discovery of host users via WMIC</a></li><li><a href="/analytics-alerts/alerts-by-name/execution-of-an-uncommon-process-at-an-early-startup-stage.md">Execution of an uncommon process at an early startup stage</a></li><li><a href="/analytics-alerts/alerts-by-name/execution-of-an-uncommon-process-with-a-local-domain-user-sid-at-an-early-startup-stage.md">Execution of an uncommon process with a local/domain user SID at an early startup stage</a></li><li><a href="/analytics-alerts/alerts-by-name/globally-uncommon-ip-address-connection-from-a-signed-process.md">Globally uncommon IP address connection from a signed process</a></li><li><a href="/analytics-alerts/alerts-by-name/globally-uncommon-high-entropy-process-was-executed.md">Globally uncommon high entropy process was executed</a></li><li><a href="/analytics-alerts/alerts-by-name/globally-uncommon-image-load-from-a-signed-process.md">Globally uncommon image load from a signed process</a></li><li><a href="/analytics-alerts/alerts-by-name/globally-uncommon-injection-from-a-signed-process.md">Globally uncommon injection from a signed process</a></li><li><a href="/analytics-alerts/alerts-by-name/globally-uncommon-process-execution-from-a-signed-process.md">Globally uncommon process execution from a signed process</a></li><li><a href="/analytics-alerts/alerts-by-name/indicator-blocking.md">Indicator blocking</a></li><li><a href="/analytics-alerts/alerts-by-name/injection-into-rundll32-exe.md">Injection into rundll32.exe</a></li><li><a href="/analytics-alerts/alerts-by-name/lolbas-executable-injects-into-another-process.md">LOLBAS executable injects into another process</a></li><li><a href="/analytics-alerts/alerts-by-name/lolbin-created-a-psscriptpolicytest-powershell-script-file.md">LOLBIN created a PSScriptPolicyTest PowerShell script file</a></li><li><a href="/analytics-alerts/alerts-by-name/linux-network-share-discovery.md">Linux network share discovery</a></li><li><a href="/analytics-alerts/alerts-by-name/local-account-discovery.md">Local account discovery</a></li><li><a href="/analytics-alerts/alerts-by-name/modification-of-pam.md">Modification of PAM</a></li><li><a href="/analytics-alerts/alerts-by-name/msiexec-execution-of-an-executable-from-an-uncommon-remote-location.md">Msiexec execution of an executable from an uncommon remote location</a></li><li><a href="/analytics-alerts/alerts-by-name/permission-groups-discovery-commands.md">Permission Groups discovery commands</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Possible DLL Side-Loading</a></li><li><a href="/analytics-alerts/alerts-by-name/possible-email-collection-using-outlook-rpc.md">Possible Email collection using Outlook RPC</a></li><li><a href="/analytics-alerts/alerts-by-name/possible-binary-padding-using-dd.md">Possible binary padding using dd</a></li><li><a href="/analytics-alerts/alerts-by-name/possible-data-obfuscation.md">Possible data obfuscation</a></li><li><a href="/analytics-alerts/alerts-by-name/psexec-was-executed-with-a-suspicious-command-line.md">PsExec was executed with a suspicious command line</a></li><li><a href="/analytics-alerts/alerts-by-name/python-http-server-started.md">Python HTTP server started</a></li><li><a href="/analytics-alerts/alerts-by-name/rare-lolbin-process-execution-by-user.md">Rare LOLBIN Process Execution by User</a></li><li><a href="/analytics-alerts/alerts-by-name/rare-unix-process-divided-files-by-size.md">Rare Unix process divided files by size</a></li><li><a href="/analytics-alerts/alerts-by-name/rare-connection-to-external-ip-address-or-host-by-an-application-using-rmi-iiop-or-ldap-protocol.md">Rare connection to external IP address or host by an application using RMI-IIOP or LDAP protocol</a></li><li><a href="/analytics-alerts/alerts-by-name/rare-process-accessed-a-keychain-file.md">Rare process accessed a Keychain file</a></li><li><a href="/analytics-alerts/alerts-by-name/remote-psexec-like-command-execution.md">Remote PsExec-like command execution</a></li><li><a href="/analytics-alerts/alerts-by-name/run-downloaded-script-using-pipe.md">Run downloaded script using pipe</a></li><li><a href="/analytics-alerts/alerts-by-name/service-execution-via-sc-exe.md">Service execution via sc.exe</a></li><li><a href="/analytics-alerts/alerts-by-name/signed-process-performed-an-unpopular-dll-injection.md">Signed process performed an unpopular DLL injection</a></li><li><a href="/analytics-alerts/alerts-by-name/signed-process-performed-an-unpopular-injection.md">Signed process performed an unpopular injection</a></li><li><a href="/analytics-alerts/alerts-by-name/space-after-filename.md">Space after filename</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-amsi-decode-attempt.md">Suspicious AMSI decode attempt</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-unicode-character-detected-in-email.md">Suspicious Unicode character detected in email</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-access-to-shadow-file.md">Suspicious access to shadow file</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-active-setup-registered.md">Suspicious active setup registered</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-container-runtime-connection-from-within-a-kubernetes-pod.md">Suspicious container runtime connection from within a Kubernetes Pod</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-curl-user-agent.md">Suspicious curl user agent</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-process-executed-with-a-high-integrity-level.md">Suspicious process executed with a high integrity level</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-process-execution-from-tmp-folder.md">Suspicious process execution from tmp folder</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-proxy-environment-variable-setting.md">Suspicious proxy environment variable setting</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-usage-of-microsoft-s-active-directory-powershell-module-remote-discovery-cmdlet.md">Suspicious usage of Microsoft's Active Directory PowerShell module remote discovery cmdlet</a></li><li><a href="/analytics-alerts/alerts-by-name/tampering-with-internet-explorer-protected-mode-configuration.md">Tampering with Internet Explorer Protected Mode configuration</a></li><li><a href="/analytics-alerts/alerts-by-name/tampering-with-the-windows-user-account-controls-uac-configuration.md">Tampering with the Windows User Account Controls (UAC) configuration</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-dotnet-module-load-relationship.md">Uncommon DotNet module load relationship</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-getclipboarddata-api-function-invocation-of-a-possible-information-stealer.md">Uncommon GetClipboardData API function invocation of a possible information stealer</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-cloud-cli-tool-usage.md">Uncommon cloud CLI tool usage</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-communication-to-an-instant-messaging-server.md">Uncommon communication to an instant messaging server</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-driver-loaded.md">Uncommon driver loaded</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-kernel-module-load.md">Uncommon kernel module load</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-macos-shell-command-execution.md">Uncommon macOS shell command execution</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Uncommon net group or localgroup execution</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-network-tunnel-creation.md">Uncommon network tunnel creation</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Uncommon remote shell command execution</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-service-stop-operation.md">Uncommon service stop operation</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Uncommon shell command execution</a></li><li><a href="/analytics-alerts/alerts-by-name/unpopular-rsync-process-execution.md">Unpopular rsync process execution</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-adconnect-database-file-access.md">Unusual ADConnect database file access</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-db-process-spawning-a-shell.md">Unusual DB process spawning a shell</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-kubernetes-service-account-file-read.md">Unusual Kubernetes service account file read</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-access-to-the-ad-sync-credential-files.md">Unusual access to the AD Sync credential files</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-access-to-the-windows-internal-database-on-an-adfs-server.md">Unusual access to the Windows Internal Database on an ADFS server</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-process-accessed-a-macos-notes-db-file.md">Unusual process accessed a macOS notes DB file</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-process-accessed-web-browser-cookies.md">Unusual process accessed web browser cookies</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-process-accessed-web-browser-credentials.md">Unusual process accessed web browser credentials</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-use-of-a-sysinternals-tool.md">Unusual use of a 'SysInternals' tool</a></li><li><a href="/analytics-alerts/alerts-by-name/vm-detection-attempt-on-linux.md">VM Detection attempt on Linux</a></li><li><a href="/analytics-alerts/alerts-by-name/web-server-cgo-executed-an-uncommon-process.md">Web server CGO executed an uncommon process</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| Improved logic of 7 Informational Analytics Alerts   | <ul><li><a href="/analytics-alerts/alerts-by-name/massive-file-activity-abnormal-to-process.md">Massive file activity abnormal to process</a></li><li><a href="/analytics-alerts/alerts-by-name/multiple-discovery-commands-on-a-linux-host-by-the-same-process.md">Multiple discovery commands on a Linux host by the same process</a></li><li><a href="/analytics-alerts/alerts-by-name/multiple-discovery-like-commands.md">Multiple discovery-like commands</a></li><li><a href="/analytics-alerts/alerts-by-name/port-scan.md">Port Scan</a></li><li><a href="/analytics-alerts/alerts-by-name/possible-data-exfiltration-over-a-usb-storage-device.md">Possible data exfiltration over a USB storage device</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-access-to-cloud-credential-files.md">Suspicious access to cloud credential files</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-container-reconnaissance-activity-in-a-kubernetes-pod.md">Suspicious container reconnaissance activity in a Kubernetes pod</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| Changed metadata of 3 Low Analytics BIOCs            | <ul><li><a href="/analytics-alerts/alerts-by-name/email-was-received-from-an-unknown-sender-using-a-disposable-domain.md">Email was received from an unknown sender using a disposable domain</a></li><li><a href="/analytics-alerts/alerts-by-name/external-email-display-name-impersonation-of-internal-personnel.md">External email display name impersonation of internal personnel</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-hostname-for-the-sending-mail-server-in-the-email-headers.md">Unusual hostname for the sending mail server in the email headers</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| Changed metadata of a Low Analytics Alert            | <ul><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Risk indicators detected in email</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| Changed metadata of 19 Informational Analytics BIOCs | <ul><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Email Punycode characters in URL(s)</a></li><li><a href="/analytics-alerts/alerts-by-name/email-attachment-with-a-potentially-malicious-file-extension.md">Email attachment with a potentially malicious file extension</a></li><li><a href="/analytics-alerts/alerts-by-name/email-attachment-with-multiple-extensions.md">Email attachment with multiple extensions</a></li><li><a href="/analytics-alerts/alerts-by-name/email-attachment-s-with-potentially-malicious-mime-type.md">Email attachment(s) with potentially malicious MIME type</a></li><li><a href="/analytics-alerts/alerts-by-name/email-containing-a-link-with-an-ip-address-convention-was-detected.md">Email containing a link with an IP address convention was detected</a></li><li><a href="/analytics-alerts/alerts-by-name/email-containing-a-redirected-link.md">Email containing a redirected link</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Email has a short body or subject and was sent from an external source</a></li><li><a href="/analytics-alerts/alerts-by-name/email-marked-as-spam-and-bulk-based-on-spam-confidence-level-and-bulk-complaint-level-values.md">Email marked as spam and bulk based on Spam Confidence Level and Bulk Complaint Level values</a></li><li><a href="/analytics-alerts/alerts-by-name/email-mimics-replies-or-forwards-without-an-actual-ongoing-conversation.md">Email mimics replies or forwards without an actual ongoing conversation</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Email suspicious Moniker link detected</a></li><li><a href="/analytics-alerts/alerts-by-name/email-was-received-from-an-unknown-address-using-a-public-provider-domain.md">Email was received from an unknown address using a public provider domain</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Email was received from an unknown sender using a recognized domain</a></li><li><a href="/analytics-alerts/alerts-by-name/email-with-url-shortener-detected.md">Email with URL shortener detected</a></li><li><a href="https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/rarely-seen-url-s-within-a-well-known-domain-detected-in-your-organization-s-email">Rarely seen URL(s) within a well-known domain detected in your organization's email</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Unpopular URL domain(s) in your organization detected in email</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Unpopular URL(s) detected in email</a></li><li><a href="https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/unpopular-domains-detected-in-email-urls-for-a-recipient">Unpopular domains detected in email URLs for a recipient</a></li><li><a href="/analytics-alerts/alerts-by-name/usage-of-homograph-characters-detected-in-an-email.md">Usage of homograph characters detected in an email</a></li><li><a href="/analytics-alerts/alerts-by-name/x-forefront-antispam-report-has-flagged-this-email-as-a-potential-threat.md">X-Forefront-Antispam-Report has flagged this email as a potential threat</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| Changed metadata of an Informational Analytics Alert | <ul><li><a href="/analytics-alerts/alerts-by-name/suspicious-theme-and-sentiment-in-email.md">Suspicious theme and sentiment in email</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2025-06-04.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
