2025.07.16

Release date: 04-August-2025

Change type	Changes
Added a new High Analytics Alert	An unusual process in ingress-nginx has accessed a service-account token file
Added a new Informational Analytics BIOC	Uncommon net localgroup command execution
Improved logic of 7 Low Analytics BIOCs	AURL - At least one sender-related domain in the email is classified as malicious An RDS snapshot was exported to an unknown S3 bucket An S3 replication policy to an unknown bucket was created Email was received from an unknown sender using a disposable domain External email display name impersonation of internal personnel LDAP AD CS Enumeration via Attack Tool Unusual hostname for the sending mail server in the email headers
Improved logic of 4 Low Analytics Alerts	Large Upload (HTTPS) Logs were not collected from a data source for an abnormally long time Risk indicators detected in email Suspicious identity downloaded multiple objects from a bucket
Improved logic of an Informational BIOC	Windows Task Manager being disabled via Registry
Improved logic of 38 Informational Analytics BIOCs	A new Azure email domain verification was requested AURL - Email contains URL(s) classified as inappropriate AURL - Email contains URL(s) classified as malicious AURL - Email was received from a newly registered domain AURL - Email was sent from a domain classified as inappropriate AURL - Unpopular domain(s) detected in an email's URL(s) AWS SES account sending settings modified AWS SSM send command attempt An AWS SES identity was deleted An Email address was added to AWS SES Cloud email sending was enabled Cloud email service activity Email Punycode characters in URL(s) Email attachment with a potentially malicious file extension Email attachment with multiple extensions Email attachment(s) with potentially malicious MIME type Email containing a link with an IP address convention was detected Email containing a redirected link Email has a short body or subject and was sent from an external source Email marked as spam and bulk based on Spam Confidence Level and Bulk Complaint Level values Email mimics replies or forwards without an actual ongoing conversation Email suspicious Moniker link detected Email was received from an unknown address using a public provider domain Email was received from an unknown sender using a recognized domain Email with URL shortener detected First SSO Resource Access in the Organization IAM role was created Possible LDAP Enumeration Tool Usage Possible LDAP Enumeration of Microsoft Configuration Manager Rarely seen URL(s) within a well-known domain detected in your organization's email Suspicious Unicode character detected in email Uncommon net group command execution Unpopular URL domain(s) in your organization detected in email Unpopular URL(s) detected in email Unpopular domains detected in email URLs for a recipient Usage of homograph characters detected in an email Usage of homograph characters detected in an email's from header X-Forefront-Antispam-Report has flagged this email as a potential threat
Improved logic of 7 Informational Analytics Alerts	A user executed multiple LDAP enumeration queries Cloud email infrastructure enumeration activity IP Rotation Pattern in SSO Spray Intense SSO failures Port Scan SSO Brute Force SSO Password Spray
Changed metadata of an Informational Analytics BIOC	A process connected to a rare cloud resource