2026.02.18
Release date: 01-March-2026
Summary
Added
4 Detectors: 4 Informational
26 Variations: 2 High, 9 Medium, 15 Low
Removed
3 Detectors: 3 Informational
17 Variations: 1 High, 6 Medium, 6 Low, 4 Informational
Modified Logic
47 Detectors: 2 High, 9 Low, 36 Informational
7 Variations: 3 Medium, 2 Low, 2 Informational
Modified Metadata
5 Detectors: 2 Low, 3 Informational
4 Variations: 4 Low
Added
[Informational] Uncommon net group command execution
[High] Uncommon unsigned net group administrators command execution
[High] Uncommon unsigned net group administrators command execution - fixed localization issues
[Medium] Uncommon administrator net group execution by scripting engine or command prompt
[Medium] Uncommon net group administrators command execution
[Low] Uncommon net group execution
[Low] Uncommon remote net group administrators command execution
[Low] Uncommon remote net group execution
[Informational] Uncommon access to /etc/passwd
[Medium] Uncommon access to /etc/passwd by a potential Webshell
[Medium] Uncommon access to /etc/passwd by a potentially known credential dumper or enumeration script
[Medium] Uncommon access to /etc/passwd by a security testing tool
[Low] Uncommon access to /etc/passwd from temporary or world writable directories
[Low] Uncommon access to /etc/passwd using an interactive binary
[Low] Uncommon access to /etc/passwd using an interactive shell
[Low] Uncommon access to /etc/passwd via a new inline bash script
[Low] Uncommon access to /etc/passwd with additional sensitive files in the command line
[Low] Uncommon access to /etc/passwd with both /etc/passwd and /etc/shadow in the command line
[Low] Uncommon access to /etc/passwd, involving a network utility
[Low] Uncommon link creation to /etc/passwd
[Informational] Uncommon net localgroup command execution
[Medium] Uncommon net localgroup administrators command execution by a web server process or CGO
[Medium] Uncommon remote net localgroup execution
[Medium] Uncommon unsigned net localgroup administrators command execution
[Medium] Uncommon unsigned net localgroup administrators command execution - fixed localization issues
[Low] Uncommon administrator net localgroup execution by scripting engine or command prompt
[Low] Uncommon net localgroup administrators command execution
[Low] Uncommon net localgroup execution
[Informational] LOLBAS executable injects into another process
[Low] LOLBAS executable injects into another process under an uncommon CGO
Removed
[Informational] Uncommon net group command execution
[High] Uncommon unsigned net group administrators command execution
[Medium] Uncommon administrator net group execution by scripting engine or command prompt
[Medium] Uncommon net group administrators command execution
[Low] Uncommon net group execution
[Low] Uncommon remote net group administrators command execution
[Low] Uncommon remote net group execution
[Informational] LOLBAS executable injects into another process
[Medium] Rare LOLBAS executable injects into another process
[Informational] LOLBAS executable injects into another process using process hollowing
[Informational] LOLBAS executable that's used to host DLLs injects into another process
[Informational] LOLBAS executable that's used to host DLLs injects into another process
[Informational] Scripting engine injects into another process
[Informational] Uncommon net localgroup command execution
[Medium] Uncommon administrator net localgroup execution by scripting engine or command prompt
[Medium] Uncommon net localgroup administrators command execution by a web server process or CGO
[Medium] Uncommon unsigned net localgroup administrators command execution
[Low] Uncommon net localgroup administrators command execution
[Low] Uncommon net localgroup execution
[Low] Uncommon remote net localgroup execution
Modified Logic
[Informational] Globally uncommon image load from a signed process
[Medium] Globally uncommon and very rare image load from a signed process - Modified Logic
[Informational] Uncommon attempt at discovering a sensitive file
[Medium] Uncommon attempt at discovering a sensitive file by a potentially known credential dumper or enumeration script - Modified Logic
[Informational] Uncommon attempt at grabbing credentials from a sensitive file
[Medium] Uncommon attempt at grabbing credentials from a sensitive file by a potentially known credential dumper or enumeration script - Modified Logic
[Low] Azure Event Hub Deletion
[Low] Azure storage account cross-tenant object replication was enabled for the first time in a subscription - Modified Metadata
[Informational] First VPN access from ASN for user
[Low] Unusual VPN access from ASN - Modified Metadata
[Informational] A cloud identity executed an API call from an unusual country
[Informational] A possible risky login to Azure
[Informational] An Azure Firewall rule collection group was modified or deleted
[Informational] An Azure Key Vault key was modified
[Informational] An identity created or updated password for an IAM user
[Informational] Authentication method added to an Azure account
[Informational] Azure AD account unlock/password reset attempt
[Informational] Azure Automation Account Creation
[Informational] Azure Automation Runbook Creation/Modification
[Informational] Azure Automation Runbook Deletion
[Informational] Azure Key Vault modification
[Informational] Azure Resource Group Deletion
[Informational] Cloud access key creation
[Informational] Successful access key creation by an unusual identity type - Modified Metadata
[Informational] Unusual successful cloud access key creation - Modified Metadata
[Informational] Cloud resource logging was disabled
[Informational] Cloud user performed multiple actions that were denied
[Informational] Compute activity in dormant cloud region
[Informational] First SSO Resource Access in the Organization
[Informational] First SSO access from ASN for user
[Informational] First SSO access from ASN in organization
[Informational] First VPN access from ASN in organization
[Informational] Okta account unlock
[Informational] Okta account unlock by admin
[Informational] Potential Okta access limit breach
[Informational] Rare NTLM Access By User To Host
[Informational] SSO Brute Force
[Informational] Suspicious SSO access from ASN
[Informational] Unusual cloud Instance Metadata Service (IMDS) access
[Informational] Unverified domain added to Azure AD
[Informational] User attempted to connect from a suspicious country
Modified Metadata
[Informational] Execution of an uncommon process at an early startup stage
[Medium -> Low] Execution of an uncommon process at an early startup stage with suspicious characteristics - Modified Metadata
[Medium -> Low] Execution of an uncommon process at an early startup stage by Windows system binary with suspicious characteristics - Modified Metadata
[Informational] Execution of an uncommon process with a local/domain user SID at an early startup stage
[Medium -> Low] Execution of an uncommon process with a local/domain user SID at an early startup stage with suspicious characteristics - Modified Metadata
[Medium -> Low] Execution of an uncommon process with a local/domain user SID at an early startup stage with a suspicious characteristics by Windows system binary - Modified Metadata
[Informational] Rare DLP rule match by user
Was this helpful?