2025.06.11

Release date: 24-June-2025

Change type	Changes
Added 2 new Low Analytics BIOCs	Office process spawned with suspicious command-line arguments Okta FastPass reported phishing attack suspected
Added a new Informational Analytics BIOC	Uncommon SQL like command line
Added a new Informational Analytics Alert	Microsoft Configuration Manager device registration and policy request
Improved logic of a High Analytics BIOC	Collection error
Improved logic of a Medium Analytics BIOC	A cloud storage object was copied to a foreign cloud account
Improved logic of 4 Medium Analytics Alerts	A cloud identity performed multiple unusual activities Possible AS-REP Roasting Attack Possible Kerberoasting attack Suspicious Azure enumeration activity
Improved logic of 7 Low Analytics BIOCs	AURL - An email was sent from a malicious domain Email was received from an unknown sender using a disposable domain External email display name impersonation of internal personnel Possible DCSync from a non domain controller Scripting engine connected to a rare external host Unusual hostname for the sending mail server in the email headers Usage of homograph characters detected in an email's from header
Improved logic of 2 Low Analytics Alerts	Risk indicators detected in email Suspicious identity downloaded multiple objects from a bucket
Improved logic of 29 Informational Analytics BIOCs	A process connected to a rare cloud resource AURL - Email contains URL(s) classified as inappropriate AURL - Email contains URL(s) classified as malicious AURL - Email was received from a newly registered domain AURL - Email was sent from a domain classified as inappropriate AURL - Unpopular domain(s) detected in an email's URL(s) AWS SES account sending settings modified Email Punycode characters in URL(s) Email attachment with a potentially malicious file extension Email attachment(s) with potentially malicious MIME type Email containing a link with an IP address convention was detected Email containing a redirected link Email has a short body or subject and was sent from an external source Email marked as spam and bulk based on Spam Confidence Level and Bulk Complaint Level values Email mimics replies or forwards without an actual ongoing conversation Email was received from an unknown address using a public provider domain Email was received from an unknown sender using a recognized domain Email with URL shortener detected Rare Remote Service (SVCCTL) RPC activity Rarely seen URL(s) within a well-known domain detected in your organization's email Suspicious Unicode character detected in email Uncommon Linux remote shell command execution Uncommon Linux shell command execution Uncommon macOS shell command execution Unpopular URL domain(s) in your organization detected in email Unpopular URL(s) detected in email Unpopular domains detected in email URLs for a recipient Usage of homograph characters detected in an email X-Forefront-Antispam-Report has flagged this email as a potential threat
Improved logic of an Informational Analytics Alert	Suspicious theme and sentiment in email
Changed metadata of an Informational Analytics BIOC	AppleScript executed a shell script
Removed an old Informational BIOC	Lsmod execution
Removed 2 old Informational Analytics BIOCs	An AWS ElastiCache security group was created An AWS ElastiCache security group was modified or deleted