2026.01.28
Release date: 09-February-2026
Summary
Added
3 Detectors: 2 Low, 1 Informational
2 Variations: 2 Medium
Removed
1 Detector: 1 Informational
8 Variations: 1 High, 2 Medium, 5 Low
Modified Logic
35 Detectors: 8 Low, 27 Informational
28 Variations: 3 High, 11 Medium, 6 Low, 8 Informational
Modified Metadata
1 Detector: 1 Informational
Added
[Medium] Potential kubelet impersonation attempt by an unusual process
[Medium] Suspicious access to Kubernetes API with kubelet credentials from unusual pod
[Informational] Unrecognized sender domain
Removed
[Informational] Uncommon process communication to a rare external host
[High] Uncommon process communication to a rare external host by an automated penetration testing tool
[Medium] Uncommon process communication to a rare external host related to LOTTunnels
[Medium] Uncommon process communication to a rare external host with a possible crypto mining tool for the first time
[Low] Uncommon process communication to a rare external host involving a code sharing website
[Low] Uncommon process communication to a rare external host with a possible exfiltration tool
[Low] Uncommon process communication to a rare external host with a rare domain public suffix
[Low] Uncommon process communication to a rare external host with an external IP in the command line
[Low] Uncommon process communication to a rare external host with global anomaly detection
Modified Logic
[Informational] A process is masquerading as a common Microsoft product
[High] An unsigned and rare actor executing masqueraded process with uncommon characteristics - Added
[Medium] A process that was executed by remote causality actor is masquerading as a common Microsoft product - Added
[Informational] Rare scheduled task created
[High] Rare scheduled task created by an injected actor - Added
[Medium] Uncommon remote scheduled task created - Modified Metadata
[Low] Highly rare scheduled task created - Modified Logic
[Low] Uncommon local scheduled task created - Modified Logic
[Low] Uncommon driver loaded
[High] Uncommon driver loaded by a Web server process - Modified Metadata
[Medium] Globally rare and unsigned driver loaded - Modified Logic
[Medium] Uncommon driver with a globally rare vendor loaded as a service - Modified Metadata
[High -> Medium] A rare DLL, signed by an uncommon vendor, was hijacked into a Microsoft process which was executed by unsigned causality actor - Modified Metadata
[High -> Medium] A rare DLL, signed by an uncommon vendor, was hijacked into an injected Microsoft process - Modified Metadata
[Medium -> Low] A rare DLL, signed by an uncommon vendor, was downloaded from an uncommon source and was loaded into Microsoft process - Modified Metadata
[Medium] An identity failed to attach an administrative policy to an IAM user or role - Modified Logic
[Low] A suspicious identity attached an administrative policy to an IAM user/role - Modified Logic
[Informational] An identity initiated a download of multiple cloud objects
[Medium] An identity initiated a download of multiple cloud objects in large volume compared to the project's usual volume - Modified Logic
[Low] An identity initiated a download of multiple cloud objects in large volume compared to the bucket's usual volume - Modified Logic
[Medium] An identity performed a suspicious download of multiple cloud storage objects - Modified Logic
[Informational] Uncommon attempt at discovering a sensitive file
[Medium] Uncommon attempt at discovering a sensitive file by a potentially known credential dumper or enumeration script - Modified Logic
[Informational] Uncommon attempt at grabbing credentials from a sensitive file
[Medium] Uncommon attempt at grabbing credentials from a sensitive file by a potentially known credential dumper or enumeration script - Modified Logic
[Informational] An identity created or updated password for an IAM user
[Low] A suspicious identity created or updated password for an IAM user - Modified Logic
[Informational -> Low] Email with file-sharing link containing auto-download parameter
[Informational] An uncommon file added to startup-related Registry keys
[Informational] An unusual read activity of cloud object
[Informational] Cloud impersonation attempt by unusual identity type
[Informational] Email attachment with a potentially malicious file extension
[Informational] Email attachment(s) with potentially malicious MIME type
[Informational] Email contains URL delivering high-risk file type
[Informational] Moniker link detected in URL(s)
[Informational] Near-empty email from an external sender
[Informational] Blank email with an attachment from an external sender - Added
[Informational] Blank email with an inline attachment from an external sender - Added
[Informational] Email has empty body or subject and was sent from an external source - Removed
[Informational] Empty email from an external sender - Modified Metadata
[Informational] Possible Privilege Escalation using Delegated MSA account
[Informational] Punycode characters detected in URL(s)
[Informational] Suspicious DKIM Result
[Informational] DKIM results lacking sender correlation - Modified Logic
[Informational] Known domain DKIM deviation - Modified Logic
[Informational] Known domain suspicious DKIM result - Modified Logic
[Informational] Uncommon URL domain(s) in your organization detected in email
[Informational] Unpopular URL(s) detected in email
[Informational] Unpopular domains detected in email URLs for a recipient
[Informational] Unrecognized sender address
[Informational] Email was received from an unknown sender with an unrecognized domain - Removed
[Informational] Unusual secret management activity
Modified Metadata
[Informational] Email with URL shortener detected
Was this helpful?