2025.11.26

Release date: 08-December-2025

Change type	Changes
Added a new Low Analytics Alert	Possible multistage attack in Microsoft Teams
Added 7 new Informational Analytics BIOCs	An identity accessed a backup cloud storage An unusual read activity of cloud object Bucket's block public access setting turned off EC2 instance Amazon machine image was created Linux local user account creation Local group enumeration via RPC Retrieval of cloud compute EC2 instance user data
Added a new Informational Analytics Alert	An identity initiated a download of multiple cloud objects
Improved logic of 2 High Analytics BIOCs	Suspicious API call from a Tor exit node Suspicious SaaS API call from a Tor exit node
Improved logic of a High Analytics Alert	Suspicious objects encryption in an AWS bucket
Improved logic of 10 Medium Analytics BIOCs	A Kubernetes API operation was successfully invoked by an anonymous user A Kubernetes dashboard service account was used outside the cluster A cloud storage object was copied to a foreign cloud account Azure AD PIM alert disabled Cloud snapshot of a database or storage instance was publicly shared Kubernetes vulnerability scanning tool usage Logging was impaired via external encryption key Penetration testing tool activity Suspicious heavy allocation of compute resources - possible mining activity Suspicious usage of EC2 token
Improved logic of 52 Low Analytics BIOCs	A Backup vault policy was modified A Command Line Interface (CLI) command was executed from a GCP serverless compute service A Command Line Interface (CLI) command was executed from an AWS serverless compute service A cloud function was created with an unusual runtime A commonly abused process connected to a rare cloud resource A suspicious direct syscall was executed AWS Guard-Duty detector deletion AWS S3 bucket was exposed to public access AWS data asset shared public AWS web ACL deletion Abnormal communication with a rare combination of TLS and HTTP User Agent An Azure Firewall policy deletion An RDS snapshot was exported to an unknown S3 bucket An S3 replication policy to an unknown bucket was created An unpopular process accessed the microphone on the host Azure AD PIM role settings change Azure Event Hub Deletion Azure Network Watcher Deletion Azure account deletion by a non-standard account Azure domain federation settings modification attempt Billing admin role was removed Conditional Access policy removed Disable encryption operations Email attachment with Right-to-Left Override Unicode character Email was received from an unknown sender using a disposable domain Execution of an uncommon process at an early startup stage by Windows system binary Execution of an uncommon process with a local/domain user SID at an early startup stage by Windows system binary First Azure AD PowerShell operation for a user GCP data asset shared public Kubernetes pod creation from unknown container image registry MFA was disabled for an Azure identity Masquerading as a default local account Microsoft Office injects code into a process Mshta.exe spawns from a browser process Non-browser access to a pastebin-like site Rare binary connected to a rare cloud resource Rare binary connected to a rare external host Recurring access to rare IP Recurring access to rare domain Recurring rare domain access from an unsigned process Recurring rare domain access to dynamic DNS domain Remote usage of an AWS service token Remote usage of an Azure Managed Identity token Sending unusual file(s) to an external address Sensitive browser credential files accessed by a rare non browser process Suspicious module load using direct syscall Uncommon file access over WebDAV Uncommon local scheduled task creation via schtasks.exe Uncommon remote monitoring and management tool Unsigned and unpopular process performed an injection Unsigned process execution by scheduled task Unusual cross projects activity
Improved logic of 11 Low Analytics Alerts	A user uploaded malware to SharePoint or OneDrive HTTP with suspicious characteristics Large Upload (Generic) Large Upload (HTTPS) Logs were not collected from a data source for an abnormally long time Microsoft 365 storage services exfiltration activity Multiple Azure AD admin role removals Risk indicators detected in email Spam Bot Traffic Suspicious activity indicating a potential abuse of a cloud-native email service Suspicious identity downloaded multiple objects from a bucket
Improved logic of 336 Informational Analytics BIOCs	A Kubernetes ConfigMap was created or deleted A Kubernetes Cronjob was created A Kubernetes DaemonSet was created A Kubernetes Pod was created with a sidecar container A Kubernetes Pod was deleted A Kubernetes ReplicaSet was created A Kubernetes StatefulSet was created A Kubernetes cluster role binding was created or deleted A Kubernetes cluster was created or deleted A Kubernetes deployment was created A Kubernetes ephemeral container was created A Kubernetes namespace was created or deleted A Kubernetes node service account activity from external IP A Kubernetes role binding was created or deleted A Kubernetes secret was created or deleted A Kubernetes service account executed an unusual API call A Kubernetes service account has enumerated its permissions A Kubernetes service account was created or deleted A Kubernetes service was created or deleted A Microsoft Teams application was installed A Microsoft Teams bot was added to a team A New Server was Added to an Azure Active Directory Hybrid Health ADFS Environment A Service Principal was created in Azure A Service Principal was removed from Azure A browser extension was installed or loaded in an uncommon way A cloud identity created or modified a security group A cloud identity executed an API call from an unusual country A cloud identity had escalated its permissions A cloud identity invoked IAM related persistence operations A cloud identity started a Cloud Shell session A cloud instance was stopped A cloud snapshot of AWS database or storage was modified or shared A cloud storage configuration was modified A compute-attached identity executed API calls outside the instance's region A container registry was created or deleted A new Azure email domain verification was requested A non-browser process accessed a website UI A process connected to a rare cloud resource A process connected to rare external host A rare DLL, signed by an uncommon vendor, was hijacked into a Microsoft process A user logged in to the AWS console for the first time A user was added to a Windows security group AWS Backup recovery point deletion AWS CloudTrail has been stopped AWS CloudTrail modification AWS CloudWatch log group deletion AWS CloudWatch log stream deletion AWS Config Recorder stopped AWS EBS snapshot deletion AWS EC2 instance exported into S3 AWS Flow Logs deletion AWS IAM resource group deletion AWS RDS cluster deletion AWS Root account activity AWS S3 object deletion AWS SES account sending settings modified AWS SSM parameters discovery AWS SSM parameters retrieval AWS SSM send command attempt AWS STS temporary credentials were generated AWS Secrets Manager Access AWS Secrets Manager discovery AWS SecurityHub findings were modified AWS Storage Gateway enumeration AWS Storage Gateway file share enumeration AWS Transfer Family server created AWS config resource deletion AWS network ACL rule creation AWS network ACL rule deletion AWS user creation Abnormal Communication to a Rare Domain Abnormal Recurring Communications to a Rare Domain Access to Kubernetes configuration file Activity in a dormant region of a cloud project An AWS EFS File-share mount was deleted An AWS EFS file-share was deleted An AWS EKS cluster was created or deleted An AWS GuardDuty IP set was created An AWS Lambda Function was created An AWS Lambda function was modified An AWS RDS Global Cluster Deletion An AWS RDS instance was created from a snapshot An AWS Route 53 domain was transferred to another AWS account An AWS S3 bucket configuration was modified An AWS SAML provider was modified An AWS SES identity was deleted An AWS database service master user password was changed An Azure DNS Zone was modified An Azure Firewall rule collection group was modified or deleted An Azure Firewall was modified An Azure Key Vault key was modified An Azure Key Vault was modified An Azure Kubernetes Cluster was created or deleted An Azure Kubernetes Role or Cluster-Role was modified An Azure Kubernetes Role-Binding or Cluster-Role-Binding was modified or deleted An Azure Kubernetes Service Account was modified or deleted An Azure Network Security Group was modified An Azure Point-to-Site VPN was modified An Azure Suppression Rule was created An Azure VPN Connection was modified An Azure application reached a throttling API rate An Azure firewall rule group was modified An Azure virtual network Device was modified An Azure virtual network was modified An EBS snapshot block was downloaded An Email address was added to AWS SES An IAM group was created An identity accessed Azure Kubernetes Secrets An identity accessed a cloud storage for the first time An identity accessed cloud storage containing sensitive data An identity attached an administrative policy to an IAM user or role An identity created or updated password for an IAM user An identity disabled bucket logging An identity started an AWS SSM session An identity was granted permissions to manage user access to Azure resources An operation was performed by an identity from a domain that was not seen in the organization An unknown account was invited to the AWS organization An unusual cloud identity was granted permissions to a BigQuery resource Attempted Azure application access from unknown tenant Aurora DB cluster stopped Authentication method added to an Azure account Authentication method was added to Azure account Azure AD PIM elevation request Azure AD account unlock/password reset attempt Azure Automation Account Creation Azure Automation Runbook Creation/Modification Azure Automation Runbook Deletion Azure Automation Webhook creation Azure Blob Container Access Level Modification Azure Event Hub Authorization rule creation/modification Azure Key Vault Secrets were modified Azure Key Vault modification Azure Kubernetes events were deleted Azure Resource Group Deletion Azure Service principal/Application creation Azure Storage Account key generated Azure Temporary Access Pass (TAP) registered to an account Azure account creation by a non-standard account Azure application URI modification Azure application consent Azure application credentials added Azure application removed Azure conditional access policy creation or modification Azure device code authentication flow used Azure diagnostic configuration deletion Azure group creation/deletion Azure mailbox rule creation Azure permission delegation granted Azure service principal assigned app role Azure storage account blob anonymous access is enabled Azure storage account cross-tenant object replication was enabled Azure storage account was publicly shared Azure user creation/deletion Azure user password reset Azure virtual machine commands execution BigQuery table or query results exfiltrated to a foreign project BitLocker key retrieval Browser bookmark files accessed by a rare non-browser process Bucket's object ownership controls were modified Cloud Organizational policy was created or modified Cloud Watch alarm deletion Cloud access key creation Cloud compute instance user data script modification Cloud compute serial console access Cloud compute volume creation attempt Cloud email sending was enabled Cloud email service activity Cloud identity reached a throttling API rate Cloud impersonation attempt by unusual identity type Cloud instance creation attempt Cloud instance deletion attempt Cloud resource logging was disabled Cloud snapshot created or modified Cloud storage automatic backup disabled Cloud storage delete protection disabled CloudTrail logging deletion Command execution in a Kubernetes pod Credentials were added to Azure application DLP sensitive data exposed to external users Data encryption was disabled Denied API call by a Kubernetes service account Device Registration Policy modification EBS snapshots were created from an EC2 instance EBS volume attachment attempt EBS volume detachment attempt EC2 snapshot attribute has been modified Email attachment with a potentially malicious file extension Email attachment with multiple extensions Email attachment(s) with potentially malicious MIME type Email containing a link with an IP address convention was detected Email containing a redirected link Email contains URL delivering high-risk file type Email has a short body or subject and was sent from an external source Email marked as spam and bulk based on Spam Confidence Level and Bulk Complaint Level values Email mimics replies or forwards without an actual ongoing conversation Email was received from an unknown address using a public provider domain Email was received from an unknown sender using a recognized domain Email with URL shortener detected Email with file-sharing link containing auto-download parameter Execution of an uncommon process at an early startup stage Execution of an uncommon process with a local/domain user SID at an early startup stage External email display name impersonation of internal personnel External email with a single internal recipient hidden in BCC External user invitation to Azure tenant First-seen email from mailbox owner to external recipient's address in the last 30 days Foreign account was granted permissions to S3 bucket via resource-based policy GCP Firewall Rule Modification GCP Firewall Rule creation GCP IAM Role Deletion GCP IAM Service Account Key Deletion GCP Logging Bucket Deletion GCP Pub/Sub Subscription Deletion GCP Pub/Sub Topic Deletion GCP Service Account Disable GCP Service Account creation GCP Service Account deletion GCP Service Account key creation GCP Storage Bucket Configuration Modification GCP Storage Bucket Permissions Modification GCP Storage Bucket deletion GCP VPC Firewall Rule Deletion GCP Virtual Private Cloud (VPC) Network Deletion GCP Virtual Private Network Route Creation GCP Virtual Private Network Route Deletion GCP administrative role granted to a cloud identity GCP logging sink deletion GCP logging sink modification GCP sensitive Cloud Run role granted GCP sensitive Deployment Manager role granted GCP sensitive Functions role granted GCP sensitive IAM role granted GCP sensitive Secret Manager role granted GCP sensitive compute role granted GCP sensitive storage role granted GCP set IAM policy activity Granting Access to an Account IAM User added to an IAM group IAM inline policy was added to group IAM inline policy was added to role IAM inline policy was added to user IAM instance profile associations were described IAM instance profile was associated with EC2 instance IAM instance profile was created IAM instance profile was replaced for EC2 instance IAM instance profiles were listed IAM policy default version was changed IAM policy version was created IAM policy was attached to group IAM policy was attached to role IAM role trust policy modification IAM role was created IAM role-attached managed policies were listed Identity assigned an Azure AD Administrator Role Kubernetes Pod Created With Sensitive Volume Kubernetes Pod Created with host Inter Process Communications (IPC) namespace Kubernetes Pod created with host process ID (PID) namespace Kubernetes Privileged Pod Creation Kubernetes admission controller activity Kubernetes cluster events deletion Kubernetes network policy modification Kubernetes pod creation with host network Kubernetes secret enumeration activity Kubernetes service account activity outside the cluster MFA device was removed/deactivated from an IAM user Microsoft Teams application setup policy was modified Microsoft Teams external communication policy was modified Microsoft Teams messages were exported from conversation Modification or Deletion of an Azure Application Gateway Detected Moniker link detected in URL(s) Network sniffing detected in Cloud environment New Teams application published to the organization catalog Object versioning was disabled OneDrive file download OneDrive file upload OneDrive folder creation Outbound email contains file-sharing service link sent to external recipient Outbound email includes an external BCC recipient observed for the first time Owner added to Azure application Owner was added to Azure application PIM privilege member removal Penetration testing tool attempt Possible Email collection using Outlook RPC Possible IPFS traffic was detected Potential creation of persistent cloud credentials Potential spoofing of internal domain spotted Privileged role used by Azure application Punycode characters detected in URL(s) Rare AppID usage to a rare destination Rare DLP rule match by user Rarely seen URL(s) within a well-known domain detected in your organization's email Remote usage of AWS Lambda's role Remote usage of VM Service Account token Remote usage of an App engine Service Account token Remote usage of an Azure Service Principal token Removal of an Azure Owner from an Application or Service Principal S3 configuration deletion SaaS suspicious external domain user activity Serial console access was enabled in AWS account Soft delete of cloud storage configuration was disabled Successful unusual guest user invitation Suspicious DKIM Result Suspicious DMARC result Suspicious MFA request reported by user in Entra ID Suspicious SPF Result Suspicious Unicode character detected in email Suspicious cloud compute instance SSH keys modification attempt Suspicious process accessed a site masquerading as Google Uncommon URL domain(s) in your organization detected in email Uncommon communication to an instant messaging server Uncommon recurring rare external host access Unpopular URL(s) detected in email Unpopular domains detected in email URLs for a recipient Unrecognized internal address (AAD mismatch) Unusual AWS CLI/SDK activity Unusual AWS systems manager activity Unusual Conditional Access operation for an identity Unusual IAM enumeration activity by a non-user Identity Unusual Identity and Access Management (IAM) activity Unusual Kubernetes secret access Unusual access to Microsoft 365 storage services Unusual certificate management activity Unusual cloud identity impersonation Unusual exec into a Kubernetes Pod Unusual hostname for the sending mail server in the email headers Unusual key management activity Unusual resource access by Azure application Unusual resource modification by newly seen IAM user Unusual resource modification/creation Unusual secret management activity Unverified domain added to Azure AD Usage of homograph characters detected in an email Usage of homograph characters detected in an email attachment(s) name Usage of homograph characters detected in an email's from header User accessed SaaS resource via anonymous link User installed an application in Microsoft Teams via Graph API X-Forefront-Antispam-Report has flagged this email as a potential threat
Improved logic of 37 Informational Analytics Alerts	Abnormal Allocation of compute resources in multiple regions Allocation of multiple cloud compute resources An Azure identity performed multiple actions that were denied An identity performed a suspicious download of multiple cloud storage objects Azure enumeration activity using Microsoft Graph API Azure uncommon increase in API request sizes Cloud email infrastructure enumeration activity Cloud infrastructure enumeration activity Cloud user performed multiple actions that were denied Deletion of multiple cloud resources External Login Password Spray External SaaS file-sharing activity External user created a Microsoft Teams conversation with suspicious operations External user started a Microsoft Teams conversation IAM Enumeration sequence Kubernetes enumeration activity Log enumeration via cloud native logging service Mailbox enumeration activity by Azure application Massive file downloads from SaaS service Massive upload to SaaS service Microsoft OneDrive enumeration activity Microsoft OneNote enumeration activity Microsoft SharePoint enumeration activity Microsoft Teams enumeration activity Multi region enumeration activity Multiple cloud snapshots export Multiple failed logins from a single IP Numerous emails sent by a single sender to multiple internal recipients Rare access to known advertising domains Short-lived Azure AD user account Storage enumeration activity Suspicious secrets dump activity Unusual attachment volume in outbound emails Upload pattern that resembles Peer to Peer traffic User exported multiple messages in Microsoft Teams via Graph API User sent messages in Microsoft Teams to multiple conversations via Graph API VPN login Brute-Force attempt
Decreased the severity to Low for an Analytics BIOC	Uncommon remote scheduled task creation
Changed metadata of a Low Analytics BIOC	Reading bash command history file
Changed metadata of a Low Analytics Alert	User collected remote shared files in an archive
Changed metadata of 2 Informational BIOCs	Evasion using time-based properties Shell history access
Changed metadata of 6 Informational Analytics BIOCs	An unusual archive file creation by a user Kubernetes nsenter container escape Remote code execution into Kubernetes Pod Uncommon Launch Agent persistency was registered or modified Uncommon Launch Daemon persistency was registered or modified Uncommon Linux shell command execution
Changed metadata of 5 Informational Analytics Alerts	A user accessed multiple unusual resources via SSO A user performed suspiciously massive file activity A user printed an unusual number of files Possible data exfiltration over a USB storage device Possible internal data exfiltration over a USB storage device