> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2025-06-11.md).

# 2025.06.11

**Release date: 24-June-2025**

| Change type                                         | Changes                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| --------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Added 2 new Low Analytics BIOCs                     | <ul><li><a href="/analytics-alerts/alerts-by-name/office-process-spawned-with-suspicious-command-line-arguments.md">Office process spawned with suspicious command-line arguments</a></li><li><a href="/analytics-alerts/alerts-by-name/okta-fastpass-reported-phishing-attack-suspected.md">Okta FastPass reported phishing attack suspected</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| Added a new Informational Analytics BIOC            | <ul><li><a href="/analytics-alerts/alerts-by-name/uncommon-sql-like-command-line.md">Uncommon SQL like command line</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
| Added a new Informational Analytics Alert           | <ul><li><a href="/analytics-alerts/alerts-by-name/microsoft-configuration-manager-device-registration-and-policy-request.md">Microsoft Configuration Manager device registration and policy request</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
| Improved logic of a High Analytics BIOC             | <ul><li><a href="/analytics-alerts/alerts-by-name/collection-error.md">Collection error</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
| Improved logic of a Medium Analytics BIOC           | <ul><li><a href="/analytics-alerts/alerts-by-name/a-cloud-storage-object-was-copied-to-a-foreign-cloud-account.md">A cloud storage object was copied to a foreign cloud account</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| Improved logic of 4 Medium Analytics Alerts         | <ul><li><a href="/analytics-alerts/alerts-by-name/a-cloud-identity-performed-multiple-unusual-activities.md">A cloud identity performed multiple unusual activities</a></li><li><a href="/analytics-alerts/alerts-by-name/possible-as-rep-roasting-attack.md">Possible AS-REP Roasting Attack</a></li><li><a href="/analytics-alerts/alerts-by-name/possible-kerberoasting-attack.md">Possible Kerberoasting attack</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-azure-enumeration-activity.md">Suspicious Azure enumeration activity</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| Improved logic of 7 Low Analytics BIOCs             | <ul><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">AURL - An email was sent from a malicious domain</a></li><li><a href="/analytics-alerts/alerts-by-name/email-was-received-from-an-unknown-sender-using-a-disposable-domain.md">Email was received from an unknown sender using a disposable domain</a></li><li><a href="/analytics-alerts/alerts-by-name/external-email-display-name-impersonation-of-internal-personnel.md">External email display name impersonation of internal personnel</a></li><li><a href="/analytics-alerts/alerts-by-name/possible-dcsync-from-a-non-domain-controller.md">Possible DCSync from a non domain controller</a></li><li><a href="/analytics-alerts/alerts-by-name/scripting-engine-connected-to-a-rare-external-host.md">Scripting engine connected to a rare external host</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-hostname-for-the-sending-mail-server-in-the-email-headers.md">Unusual hostname for the sending mail server in the email headers</a></li><li><a href="/analytics-alerts/alerts-by-name/usage-of-homograph-characters-detected-in-an-email-s-from-header.md">Usage of homograph characters detected in an email's from header</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
| Improved logic of 2 Low Analytics Alerts            | <ul><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Risk indicators detected in email</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-identity-downloaded-multiple-objects-from-a-bucket.md">Suspicious identity downloaded multiple objects from a bucket</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Improved logic of 29 Informational Analytics BIOCs  | <ul><li><a href="/analytics-alerts/alerts-by-name/a-process-connected-to-a-rare-cloud-resource.md">A process connected to a rare cloud resource</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">AURL - Email contains URL(s) classified as inappropriate</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">AURL - Email contains URL(s) classified as malicious</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">AURL - Email was received from a newly registered domain</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">AURL - Email was sent from a domain classified as inappropriate</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">AURL - Unpopular domain(s) detected in an email's URL(s)</a></li><li><a href="/analytics-alerts/alerts-by-name/aws-ses-account-sending-settings-modified.md">AWS SES account sending settings modified</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Email Punycode characters in URL(s)</a></li><li><a href="/analytics-alerts/alerts-by-name/email-attachment-with-a-potentially-malicious-file-extension.md">Email attachment with a potentially malicious file extension</a></li><li><a href="/analytics-alerts/alerts-by-name/email-attachment-s-with-potentially-malicious-mime-type.md">Email attachment(s) with potentially malicious MIME type</a></li><li><a href="/analytics-alerts/alerts-by-name/email-containing-a-link-with-an-ip-address-convention-was-detected.md">Email containing a link with an IP address convention was detected</a></li><li><a href="/analytics-alerts/alerts-by-name/email-containing-a-redirected-link.md">Email containing a redirected link</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Email has a short body or subject and was sent from an external source</a></li><li><a href="/analytics-alerts/alerts-by-name/email-marked-as-spam-and-bulk-based-on-spam-confidence-level-and-bulk-complaint-level-values.md">Email marked as spam and bulk based on Spam Confidence Level and Bulk Complaint Level values</a></li><li><a href="/analytics-alerts/alerts-by-name/email-mimics-replies-or-forwards-without-an-actual-ongoing-conversation.md">Email mimics replies or forwards without an actual ongoing conversation</a></li><li><a href="/analytics-alerts/alerts-by-name/email-was-received-from-an-unknown-address-using-a-public-provider-domain.md">Email was received from an unknown address using a public provider domain</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Email was received from an unknown sender using a recognized domain</a></li><li><a href="/analytics-alerts/alerts-by-name/email-with-url-shortener-detected.md">Email with URL shortener detected</a></li><li><a href="/analytics-alerts/alerts-by-name/rare-remote-service-svcctl-rpc-activity.md">Rare Remote Service (SVCCTL) RPC activity</a></li><li><a href="https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/rarely-seen-url-s-within-a-well-known-domain-detected-in-your-organization-s-email">Rarely seen URL(s) within a well-known domain detected in your organization's email</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-unicode-character-detected-in-email.md">Suspicious Unicode character detected in email</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-linux-remote-shell-command-execution.md">Uncommon Linux remote shell command execution</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-linux-shell-command-execution.md">Uncommon Linux shell command execution</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-macos-shell-command-execution.md">Uncommon macOS shell command execution</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Unpopular URL domain(s) in your organization detected in email</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Unpopular URL(s) detected in email</a></li><li><a href="https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/unpopular-domains-detected-in-email-urls-for-a-recipient">Unpopular domains detected in email URLs for a recipient</a></li><li><a href="/analytics-alerts/alerts-by-name/usage-of-homograph-characters-detected-in-an-email.md">Usage of homograph characters detected in an email</a></li><li><a href="/analytics-alerts/alerts-by-name/x-forefront-antispam-report-has-flagged-this-email-as-a-potential-threat.md">X-Forefront-Antispam-Report has flagged this email as a potential threat</a></li></ul> |
| Improved logic of an Informational Analytics Alert  | <ul><li><a href="/analytics-alerts/alerts-by-name/suspicious-theme-and-sentiment-in-email.md">Suspicious theme and sentiment in email</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| Changed metadata of an Informational Analytics BIOC | <ul><li><a href="/analytics-alerts/alerts-by-name/applescript-executed-a-shell-script.md">AppleScript executed a shell script</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| Removed an old Informational BIOC                   | <ul><li>Lsmod execution</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
| Removed 2 old Informational Analytics BIOCs         | <ul><li>An AWS ElastiCache security group was created</li><li>An AWS ElastiCache security group was modified or deleted</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2025-06-11.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.