2025.09.03

Release date: 17-September-2025

Change type	Changes
Added 4 new Low Analytics BIOCs	Mshta.exe spawns from a browser process PowerShell runs suspicious base64-encoded commands Recurring access to rare domain Uncommon sensitive registry hive dump
Added 14 new Informational Analytics BIOCs	A cloud identity started a Cloud Shell session A third-party utility was copied to a different location An EBS snapshot block was downloaded An unknown account was invited to the AWS organization Cloud compute volume creation attempt Cloud instance creation attempt Cloud instance deletion attempt EBS volume attachment attempt EBS volume detachment attempt Execution of masqueraded third-party utility Execution of renamed lolbin Potential creation of persistent cloud credentials Unusual AWS CLI/SDK activity Unusual Kubernetes secret access
Improved logic of 6 Medium Analytics BIOCs	A cloud storage object was copied to a foreign cloud account Correlation rule error Error in event forwarding Kubernetes vulnerability scanning tool usage Parsing Rule Error Penetration testing tool activity
Improved logic of a Medium Analytics Alert	A new machine attempted Kerberos delegation
Improved logic of 10 Low Analytics BIOCs	Azure account deletion by a non-standard account Email attachment with Right-to-Left Override Unicode character Email was received from an unknown sender using a disposable domain External email display name impersonation of internal personnel Linux system firewall was modified Potential SCCM credential harvesting using WMI detected Rare process created an SSH session to an uncommon cloud resource Rare process created an SSH session to an uncommon external host Suspicious access of the System Management Container Suspicious modification of the AdminSDHolder's ACL
Improved logic of 6 Low Analytics Alerts	A compromised process accessed a rare external host An identity dumped multiple secrets from a project Large Upload (Generic) Large Upload (HTTPS) Logs were not collected from a data source for an abnormally long time Risk indicators detected in email
Improved logic of 49 Informational Analytics BIOCs	A cloud identity had escalated its permissions A process connected to a rare cloud resource A process connected to rare external host A user was added to a Windows security group AWS STS temporary credentials were generated Activity in a dormant region of a cloud project An identity started an AWS SSM session Authentication method added to an Azure account Azure AD account unlock/password reset attempt Azure account creation by a non-standard account Azure device code authentication flow used Azure permission delegation granted Cloud impersonation attempt by unusual identity type Email Punycode characters in URL(s) Email attachment with a potentially malicious file extension Email attachment with multiple extensions Email attachment(s) with potentially malicious MIME type Email containing a link with an IP address convention was detected Email containing a redirected link Email contains URL delivering high-risk file type Email has a short body or subject and was sent from an external source Email marked as spam and bulk based on Spam Confidence Level and Bulk Complaint Level values Email mimics replies or forwards without an actual ongoing conversation Email suspicious Moniker link detected Email was received from an unknown address using a public provider domain Email was received from an unknown sender using a recognized domain Email with URL shortener detected Email with file-sharing link containing auto-download parameter Identity assigned an Azure AD Administrator Role Penetration testing tool activity attempt Penetration testing tool attempt Potential DCSync by an unusual user Rarely seen URL(s) within a well-known domain detected in your organization's email SSO with abnormal user agent Sending unusual file(s) to an external address Suspicious SPF Result Suspicious Unicode character detected in email Unpopular URL domain(s) in your organization detected in email Unpopular URL(s) detected in email Unpopular domains detected in email URLs for a recipient Unrecognized internal address (AAD mismatch) Unusual AWS systems manager activity Unusual Identity and Access Management (IAM) activity Unusual cloud identity impersonation Unusual hostname for the sending mail server in the email headers Unusual resource modification/creation Usage of homograph characters detected in an email Usage of homograph characters detected in an email's from header X-Forefront-Antispam-Report has flagged this email as a potential threat
Improved logic of 10 Informational Analytics Alerts	Abnormal SMB scanning activity to multiple hosts Cloud email infrastructure enumeration activity Cloud infrastructure enumeration activity Internal Login Password Spray Multi region enumeration activity Multiple failed logins from a single IP Numerous emails sent by a single sender to multiple internal recipients Possible Privilege Escalation using Delegated MSA account Suspicious theme and sentiment in email Unusual attachment volume in outbound emails
Decreased the severity to Informational for an Analytics BIOC	Modification of NTLM restrictions in the Registry
Changed metadata of 2 Low Analytics BIOCs	First Azure AD PowerShell operation for a user Okta FastPass reported phishing attack suspected
Changed metadata of 3 Informational Analytics BIOCs	A possible risky login to Azure Cloud compute serial console access Suspicious cloud compute instance SSH keys modification attempt
Removed 2 old Medium Analytics BIOCs	PowerShell runs suspicious base64-encoded commands Vulnerable driver loaded
Removed an old Low BIOC	Mshta.exe spawns from a browser
Removed an old Low Analytics BIOC	Execution of renamed lolbin