2026.01.07

Release date: 25-January-2026

Summary

Added

• 4 Detectors: 1 Low, 3 Informational
• 7 Variations: 1 High, 2 Medium, 4 Low

Removed

• 1 Detector: 1 Informational
• 5 Variations: 2 Medium, 3 Low

Modified Logic

• 157 Detectors: 3 Medium, 16 Low, 138 Informational
• 19 Variations: 6 Medium, 5 Low, 8 Informational

Modified Metadata

• 1 Detector: 1 Informational
• 1 Variation: 1 Low

Temporarily Removed

• 1 Detector: 1 Informational
• 6 Variations: 6 Informational

Added

• [Informational] Unsigned DLL Side-Loading

  • [High] DLL Side-Loading of module bearing an invalid Microsoft signature
  • [Medium] Unsigned DLL Side-Loading to a signed microsoft process by a rare causality actor
  • [Low] Unsigned DLL Side-Loading - DLL downloaded from an uncommon source
  • [Low] Unsigned DLL Side-Loading to a signed microsoft process
  • [Low] Unsigned high entropy DLL Side-Loading by untrusted causality actor
• [Low] Suspicious account attribute modification that matches that of another account

  • [Medium] Suspicious account attribute modification that matches that of a sensitive machine account
• [Informational] Possible Kerberos User Enumeration

  • [Low] Possible Kerberos User Enumeration Involving Exposed Users
• [Informational] Web server CGO executed a process following a potential Webshell dropped

Removed

• [Informational] Possible DLL Side-Loading

  • [Medium] Possible DLL Side-Loading - DLL downloaded from an uncommon source
  • [Medium] Possible DLL Side-Loading of a module with highly suspicious characteristics
  • [Low] Globally Uncommon DLL Side-Loading
  • [Low] Possible DLL Side-Loading by a known actor in the organization
  • [Low] Possible DLL Side-Loading of a module with suspicious characteristics

Modified Logic

• [Medium] A cloud storage object was copied to a foreign cloud account
• [Medium] Cloud snapshot of a database or storage instance was publicly shared
• [Low] LOLBIN process executed with a high integrity level

  • [Medium] LOLBIN process executed with a high integrity level by a web server process or CGO - Modified Logic
• [Low] Multiple discovery commands

  • [Medium] Multiple discovery commands from a web server CGO - Modified Logic
• [Low] Possible external RDP Brute-Force

  • [Medium] Possible external RDP Brute-Force on a Honey User Account - Modified Metadata
• [Medium] Possible new DHCP server
• [Informational] Uncommon attempt at discovering a sensitive file

  • [Medium] Uncommon attempt at discovering a sensitive file by a potentially known credential dumper or enumeration script - Modified Logic
  • [Informational] Uncommon attempt at discovering /etc/passwd - Removed
• [Informational] Uncommon attempt at grabbing credentials from a sensitive file

  • [Medium] Uncommon attempt at grabbing credentials from a sensitive file by a potentially known credential dumper or enumeration script - Modified Logic
• [Informational] Uncommon net localgroup command execution

  • [Medium] Uncommon net localgroup administrators command execution by a web server process or CGO - Modified Logic
• [Low] A Backup vault policy was modified
• [Low] A compromised process accessed a rare external host
• [Low] AWS S3 bucket was exposed to public access
• [Low] AWS data asset shared public
• [Informational] An Azure application reached a throttling API rate

  • [Low] An Azure application reached an unusual throttling API rate - Modified Logic
  • [Informational] An Azure application reached an unusual throttling API rate - Modified Logic
• [Low] An RDS snapshot was exported to an unknown S3 bucket
• [Low] Email was received from an unknown sender using a disposable domain
• [Low] GCP data asset shared public
• [Informational] Member added to a Windows local security group

  • [Low] User added to the Windows local Administrator group - Modified Logic
• [Low] Microsoft 365 storage services exfiltration activity
• [Low] Possible webshell file written by a web server process
• [Informational] Privileged role used by Azure application

  • [Low] First-time privileged role is used by Azure application - Modified Logic
• [Low] Risk indicators detected in email
• [Low] Suspicious activity on logging bucket
• [Low] Suspicious identity downloaded multiple objects from a bucket
• [Low] Unusual cross projects activity
• [Informational] User installed an application in Microsoft Teams via Graph API

  • [Low] User installed an application in Microsoft Teams via Graph API from a first seen ASN - Modified Metadata
• [Informational] User sent messages in Microsoft Teams to multiple conversations via Graph API

  • [Low] User sent messages in Microsoft Teams to several conversations via Graph API with suspicious characteristics - Modified Metadata
• [Informational] A Kubernetes ConfigMap was created or deleted
• [Informational] A Kubernetes Cronjob was created
• [Informational] A Kubernetes cluster role binding was created or deleted
• [Informational] A Kubernetes cluster was created or deleted
• [Informational] A Kubernetes ephemeral container was created
• [Informational] A Kubernetes namespace was created or deleted
• [Informational] A Kubernetes role binding was created or deleted
• [Informational] A Kubernetes secret was created or deleted
• [Informational] A Kubernetes service account was created or deleted
• [Informational] A Kubernetes service was created or deleted
• [Informational] A cloud identity created or modified a security group
• [Informational] A cloud identity executed an API call from an unusual country
• [Informational] A cloud identity had escalated its permissions
• [Informational] A cloud identity invoked IAM related persistence operations
• [Informational] A cloud identity started a Cloud Shell session
• [Informational] A cloud instance was stopped
• [Informational] A cloud snapshot of AWS database or storage was modified or shared
• [Informational] A compromised process accessed a rare cloud resource
• [Informational] A container registry was created or deleted
• [Informational] AWS Backup recovery point deletion
• [Informational] AWS EBS enumeration activity
• [Informational] AWS EBS snapshot deletion
• [Informational] AWS EC2 infrastructure enumeration activity
• [Informational] AWS Flow Logs deletion
• [Informational] AWS Lambda infrastructure enumeration activity
• [Informational] AWS S3 Buckets enumeration activity
• [Informational] AWS S3 object deletion
• [Informational] AWS SSM parameters discovery
• [Informational] AWS SSM parameters retrieval
• [Informational] AWS Secrets Manager Access
• [Informational] AWS Secrets Manager discovery
• [Informational] AWS Storage Gateway enumeration
• [Informational] AWS Storage Gateway file share enumeration
• [Informational] AWS Transfer Family server created
• [Informational] Activity in a dormant region of a cloud project
• [Informational] An Azure identity performed multiple actions that were denied
• [Informational] An EBS snapshot block was downloaded
• [Informational] An identity accessed a backup cloud storage
• [Informational] An identity accessed a cloud storage for the first time
• [Informational] An identity accessed cloud storage containing sensitive data
• [Informational] An identity attached an administrative policy to an IAM user or role
• [Informational] An identity initiated a download of multiple cloud objects
• [Informational] An identity performed a suspicious download of multiple cloud storage objects
• [Informational] An unknown account was invited to the AWS organization
• [Informational] An unusual cloud identity was granted permissions to a BigQuery resource
• [Informational] An unusual read activity of cloud object
• [Informational] Azure enumeration activity using Microsoft Graph API
• [Informational] Azure storage account blob anonymous access is enabled
• [Informational] Azure storage account was publicly shared
• [Informational] BigQuery table or query results exfiltrated to a foreign project
• [Informational] Bucket's block public access setting turned off
• [Informational] Bucket's object ownership controls were modified
• [Informational] Cloud access key creation
• [Informational] Cloud compute instance user data script modification
• [Informational] Cloud compute serial console access
• [Informational] Cloud compute volume creation attempt
• [Informational] Cloud email infrastructure enumeration activity
• [Informational] Cloud identity reached a throttling API rate
• [Informational] Cloud impersonation attempt by unusual identity type

  • [Informational] Cloud impersonation attempt of a management role by unusual identity type - Modified Logic
• [Informational] Cloud infrastructure enumeration activity
• [Informational] Cloud instance creation attempt
• [Informational] Cloud instance deletion attempt
• [Informational] Cloud snapshot created or modified
• [Informational] CloudTrail logging deletion
• [Informational] Data encryption was disabled
• [Informational] Deletion of multiple cloud resources
• [Informational] EBS volume attachment attempt
• [Informational] EBS volume detachment attempt
• [Informational] EC2 instance Amazon machine image was created
• [Informational] Email containing a redirected link
• [Informational] Email has a short body or subject and was sent from an external source

  • [Informational] Email has empty body and subject and was sent from an external source - Modified Logic
  • [Informational] Email has empty body or subject and was sent from an external source - Modified Logic
• [Informational] Email mimics replies or forwards without an actual ongoing conversation
• [Informational] Email was received from an unknown address using a public provider domain
• [Informational] Email was received from an unknown sender using a recognized domain
• [Informational] External email display name impersonation of internal personnel
• [Informational] External user added a link to a Microsoft Teams chat
• [Informational] Foreign account was granted permissions to S3 bucket via resource-based policy
• [Informational] GCP logging sink modification
• [Informational] IAM Enumeration sequence
• [Informational] IAM User added to an IAM group
• [Informational] IAM inline policy was added to group
• [Informational] IAM inline policy was added to role
• [Informational] IAM inline policy was added to user
• [Informational] IAM instance profile associations were described
• [Informational] IAM instance profile was associated with EC2 instance
• [Informational] IAM instance profile was created
• [Informational] IAM instance profile was replaced for EC2 instance
• [Informational] IAM instance profiles were listed
• [Informational] IAM policy default version was changed
• [Informational] IAM policy version was created
• [Informational] IAM policy was attached to group
• [Informational] IAM policy was attached to role
• [Informational] IAM role trust policy modification
• [Informational] IAM role was created
• [Informational] IAM role-attached managed policies were listed
• [Informational] Kubernetes cluster events deletion
• [Informational] Kubernetes enumeration activity
• [Informational] Kubernetes network policy modification
• [Informational] Log enumeration via cloud native logging service
• [Informational] Mailbox enumeration activity by Azure application
• [Informational] Microsoft OneDrive enumeration activity
• [Informational] Microsoft OneNote enumeration activity
• [Informational] Microsoft SharePoint enumeration activity
• [Informational] Microsoft Teams enumeration activity
• [Informational] Multi region enumeration activity
• [Informational] Multiple failed logins from a single IP
• [Informational] Network sniffing detected in Cloud environment
• [Informational] Numerous emails sent by a single sender to multiple internal recipients
• [Informational] Possible authentication coercion
• [Informational] Potential creation of persistent cloud credentials
• [Informational] Retrieval of cloud compute EC2 instance user data
• [Informational] Serial console access was enabled in AWS account
• [Informational] Storage enumeration activity
• [Informational] Suspicious DKIM Result

  • [Informational] DKIM results lacking sender correlation - Modified Logic
  • [Informational] Known domain DKIM deviation - Modified Logic
• [Informational] Suspicious Unicode character detected in email
• [Informational] Suspicious secrets dump activity
• [Informational] Uncommon increase in Azure Microsoft Graph API request sizes
• [Informational] Unpopular URL(s) detected in email
• [Informational] Unrecognized internal address (AAD mismatch)
• [Informational] Unusual AWS CLI/SDK activity
• [Informational] Unusual AWS systems manager activity
• [Informational] Unusual Identity and Access Management (IAM) activity
• [Informational] Unusual Kubernetes secret access
• [Informational] Unusual access to Microsoft 365 storage services
• [Informational] Unusual cloud identity impersonation

  • [Informational] Unusual cloud identity impersonation of a management role - Modified Logic
• [Informational] Unusual display name in From header
• [Informational] Unusual hostname for the sending mail server in the email headers
• [Informational] Unusual resource modification by newly seen IAM user
• [Informational] Unusual user-agent for a cloud identity
• [Informational] Well-known brand in sender headers with header inconsistencies

Modified Metadata

• [Informational] VPN login Brute-Force attempt

  • [Low] VPN login brute-force attempt with suspicious characteristics - Modified Metadata

Temporarily Removed

• [Informational] Abnormal Communication to a Rare IP

  • [Informational] Abnormal Communication to a Rare IP From an Unmanaged Host
  • [Informational] Abnormal Communication to a Rare IP Using a Gaming Protocol
  • [Informational] Abnormal Communication to a Rare IP Using a Peer to Peer Protocol
  • [Informational] Abnormal Communication to a Rare IP Using a Video and Audio Conversation Protocol
  • [Informational] Abnormal Communication to a Rare IP With a NetBIOS Port
  • [Informational] Abnormal Communication to a Rare IP With a Port Commonly Used by Attack Platforms