2026.02.25

Release date: 10-March-2026

Summary

Added

• 14 Detectors: 2 Low, 12 Informational
• 36 Variations: 2 High, 10 Medium, 23 Low, 1 Informational

Removed

• 6 Detectors: 1 Low, 5 Informational
• 17 Variations: 1 High, 6 Medium, 6 Low, 4 Informational

Modified Logic

• 249 Detectors: 2 High, 7 Medium, 44 Low, 196 Informational
• 52 Variations: 7 High, 16 Medium, 21 Low, 8 Informational

Modified Metadata

• 7 Detectors: 2 Low, 5 Informational
• 6 Variations: 1 High, 4 Low, 1 Informational

Added

• [Informational] Uncommon net group command execution

  • [High] Uncommon unsigned net group administrators command execution
  • [High] Uncommon unsigned net group administrators command execution - fixed localization issues
  • [Medium] Uncommon administrator net group execution by scripting engine or command prompt
  • [Medium] Uncommon net group administrators command execution
  • [Low] Uncommon net group execution
  • [Low] Uncommon remote net group administrators command execution
  • [Low] Uncommon remote net group execution
• [Informational] Uncommon Linux process communication to a rare external host

  • [Medium] Uncommon Linux process communication to a rare external host by an automated penetration testing tool
  • [Low] Uncommon Linux process communication to a rare external host identified as global anomaly
  • [Low] Uncommon Linux process communication to a rare external host involving a code sharing website
  • [Low] Uncommon Linux process communication to a rare external host involving a low-prevalence process connecting to a rare Top-Level Domain
  • [Low] Uncommon Linux process communication to a rare external host using a data transfer tool
  • [Low] Uncommon Linux process communication to a rare external host with an external IP in the command line
• [Informational] Uncommon access to /etc/passwd

  • [Medium] Uncommon access to /etc/passwd by a potential Webshell
  • [Medium] Uncommon access to /etc/passwd by a potentially known credential dumper or enumeration script
  • [Medium] Uncommon access to /etc/passwd by a security testing tool
  • [Low] Uncommon access to /etc/passwd from temporary or world writable directories
  • [Low] Uncommon access to /etc/passwd using an interactive binary
  • [Low] Uncommon access to /etc/passwd using an interactive shell
  • [Low] Uncommon access to /etc/passwd via a new inline bash script
  • [Low] Uncommon access to /etc/passwd with additional sensitive files in the command line
  • [Low] Uncommon access to /etc/passwd with both /etc/passwd and /etc/shadow in the command line
  • [Low] Uncommon access to /etc/passwd, involving a network utility
  • [Low] Uncommon link creation to /etc/passwd
• [Informational] Uncommon net localgroup command execution

  • [Medium] Uncommon net localgroup administrators command execution by a web server process or CGO
  • [Medium] Uncommon remote net localgroup execution
  • [Medium] Uncommon unsigned net localgroup administrators command execution
  • [Medium] Uncommon unsigned net localgroup administrators command execution - fixed localization issues
  • [Low] Uncommon administrator net localgroup execution by scripting engine or command prompt
  • [Low] Uncommon net localgroup administrators command execution
  • [Low] Uncommon net localgroup execution
• [Informational] AWS Security Service Enumeration

  • [Low] AWS Multiple Security Services Enumeration
• [Informational] LOLBAS executable injects into another process

  • [Low] LOLBAS executable injects into another process under an uncommon CGO
• [Low] Machine Account NTLM Relay
• [Informational] Sensitive browser credential files accessed by a rare non browser process

  • [Low] Sensitive browser credential files accessed by a rare non browser process from a commonly abused directory
• [Informational] Suspicious AWS SSM parameters retrieval activity

  • [Low] A non admin identity extracted multiple secrets within the organization across multiple regions
• [Low] Suspicious Kerberos Pre-Auth Failures by Host
• [Informational] A cloud storage configuration was modified
• [Informational] AWS console login without MFA
• [Informational] An RDS snapshot was exported to an unknown bucket

  • [Informational] Failed RDS snapshot export attempt to an unknown bucket
• [Informational] Unusual internal access to network device management interface

Removed

• [Informational] Uncommon net group command execution

  • [High] Uncommon unsigned net group administrators command execution
  • [Medium] Uncommon administrator net group execution by scripting engine or command prompt
  • [Medium] Uncommon net group administrators command execution
  • [Low] Uncommon net group execution
  • [Low] Uncommon remote net group administrators command execution
  • [Low] Uncommon remote net group execution
• [Informational] LOLBAS executable injects into another process

  • [Medium] Rare LOLBAS executable injects into another process
  • [Informational] LOLBAS executable injects into another process using process hollowing
  • [Informational] LOLBAS executable that's used to host DLLs injects into another process
  • [Informational] LOLBAS executable that's used to host DLLs injects into another process
  • [Informational] Scripting engine injects into another process
• [Informational] Uncommon net localgroup command execution

  • [Medium] Uncommon administrator net localgroup execution by scripting engine or command prompt
  • [Medium] Uncommon net localgroup administrators command execution by a web server process or CGO
  • [Medium] Uncommon unsigned net localgroup administrators command execution
  • [Low] Uncommon net localgroup administrators command execution
  • [Low] Uncommon net localgroup execution
  • [Low] Uncommon remote net localgroup execution
• [Low] Sensitive browser credential files accessed by a rare non browser process
• [Informational] A cloud storage configuration was modified
• [Informational] Unpopular URL(s) detected in email

Modified Logic

• [Low] ClickFix - PowerShell executed through the run application

  • [High] ClickFix - Schedule task PowerShell command executed through the run application - Added
• [High] Cloud penetration testing tool activity
• [Informational] Compute activity in dormant cloud region

  • [High] Compute activity in dormant cloud region by a compromised AWS access key - Modified Metadata
  • [Informational] Compute activity in dormant cloud region from a non-VPN IP address - Added
• [Informational] Multiple cloud snapshots export

  • [High] 062ca644-b34a-4d95-9ddb-41bce814f5a9 - Added
  • [High] f17228e4_558f_46bd_bb83_5c26896ef9bb - Removed
• [Informational] Remote usage of AWS Lambda's role

  • [High] Remote command line usage of AWS Lambda's role - Removed
  • [High] Remote command line usage of AWS Lambda's role - Added
• [High] Suspicious API call from a Tor exit node
• [Informational] Unsigned DLL Side-Loading

  • [High] DLL Side-Loading of module bearing an invalid Microsoft signature - Modified Logic
  • [Medium] Unsigned DLL Side-Loading to a signed microsoft process by a rare causality actor - Modified Logic
  • [Low] Unsigned high entropy DLL Side-Loading by untrusted causality actor - Modified Logic
• [Medium] A Kubernetes dashboard service account was used outside the cluster
• [Medium] A cloud storage object was copied to a foreign cloud account
• [Low] A process queried the ADFS database decryption key via LDAP

  • [Medium] A process explicitly queried the ADFS database decryption key (DKM key) via LDAP - Modified Logic
• [Medium] Azure AD PIM alert disabled
• [Low] Azure account deletion by a non-standard account

  • [Medium] A suspicious Azure account deletion by a non-standard account - Modified Logic
• [Informational] Azure application credentials added

  • [Medium] Suspicious credential operation on an Azure application - Modified Logic
  • [Low] Unusual certificate operation on an Azure application - Modified Logic
• [Medium] Cloud snapshot of a database or storage instance was publicly shared
• [Informational] Globally uncommon image load from a signed process

  • [Medium] Globally uncommon and very rare image load from a signed process - Modified Logic
• [Medium] Kubernetes vulnerability scanning tool usage

  • [Medium] External Kubernetes vulnerability scanning tool usage - Modified Logic
• [Low] LOLBIN process executed with a high integrity level

  • [Medium] LOLBIN process executed with a high integrity level by a web server process or CGO - Modified Logic
• [Low] Multiple user accounts failed login due to account lockouts

  • [Medium] Excessive user account login failure due to lockout from a suspicious source - Removed
  • [Medium] Excessive user account login failure due to lockout from a suspicious source - Added
• [Low] Possible DCSync from a non domain controller

  • [Medium] Possible DCSync from an internet-facing server - Removed
  • [Medium] Possible DCSync from an internet-facing server - Added
• [Medium] Script file added to startup-related Registry keys
• [Medium] Suspicious PowerSploit's recon module (PowerView) net function was executed
• [Low] Suspicious usage of EC2 token

  • [Medium] Suspicious usage of EC2 token - Modified Logic
• [Informational] Uncommon SQL like command line

  • [Medium] Uncommon SQL like command line executed by a remote actor - Modified Metadata
  • [Medium] Uncommon SQL like command line executed by an RMM tool - Modified Logic
  • [Low] Uncommon SQL like command line executed by an uncommon CGO - Modified Logic
• [Informational] Uncommon attempt at discovering a sensitive file

  • [Medium] Uncommon attempt at discovering a sensitive file by a potentially known credential dumper or enumeration script - Modified Logic
• [Informational] Uncommon attempt at grabbing credentials from a sensitive file

  • [Medium] Uncommon attempt at grabbing credentials from a sensitive file by a potentially known credential dumper or enumeration script - Modified Logic
• [Low] A Backup vault policy was modified
• [Informational] A Kubernetes node service account activity from external IP

  • [Low] A Kubernetes node service account was used outside the cluster - Modified Logic
• [Informational] A process connected to a rare external host

  • [Low] UNIX LOLBIN process connected to a rare external host - Modified Logic
• [Low] A rare file path was added to the AppInit_DLLs registry value
• [Low] AWS S3 bucket was exposed to public access
• [Low] AWS data asset shared public
• [Informational] Abnormal network communication with a rare combination of HTTP User Agent and HTTP Server

  • [Low] Abnormal network communication with a rare combination of HTTP User Agent and HTTP Server where both the User Agent and the HTTP Server are rare - Removed
  • [Low] Abnormal network communication with a rare combination of HTTP User Agent and HTTP Server where both the User Agent and the HTTP Server are rare - Added
• [Informational] An AWS database service master user password was changed

  • [Low] An AWS Database Service master user password was changed from an unusual country - Modified Logic
• [Low] An RDS snapshot was exported to an unknown S3 bucket
• [Low] Authentication attempt by a honey user
• [Low] Azure AD PIM role settings change
• [Low] Azure Event Hub Deletion
• [Low] Azure domain federation settings modification attempt
• [Informational] Azure storage account cross-tenant object replication was enabled

  • [Low] Azure storage account cross-tenant object replication was enabled for the first time in a subscription - Modified Metadata
• [Low] Email attachment with Right-to-Left Override Unicode character
• [Low] Email was received from an unknown sender using a disposable domain
• [Low] Email with file-sharing link containing auto-download parameter
• [Low] Executable or Script file written by a web server process

  • [Low] Executable or Script file written by a web server process with connections from various sources and high web traffic - Modified Logic
• [Informational] External user added a link to a Microsoft Teams chat

  • [Low] An external user sent a link via Microsoft Teams with suspicious parameters - Modified Logic
• [Low] First Azure AD PowerShell operation for a user
• [Informational] First VPN access from ASN for user

  • [Low] Unusual VPN access from ASN - Modified Metadata
• [Low] GCP data asset shared public
• [Informational] Globally uncommon high entropy process was executed

  • [Low] Globally uncommon high entropy process was executed by a web server process or CGO - Modified Logic
• [Low] Impossible traveler - SSO

  • [Informational] SSO impossible traveler from a VPN or proxy - Removed
  • [Informational] SSO impossible traveler from a VPN or proxy - Added
• [Informational] Kubernetes service account activity outside the cluster

  • [Low] Kubernetes service account activity outside the cluster from non-cloud IP - Modified Logic
• [Low] MFA was disabled for an Azure identity
• [Low] Multiple Azure AD admin role removals
• [Low] Possible DLL Search Order Hijacking

  • [Low] Possible DLL Search Order Hijacking - DLL downloaded from an uncommon source - Modified Metadata
  • [Low] Possible DLL Search Order Hijacking - DLL extracted from an internet-downloaded archive - Modified Metadata
  • [Low] Possible DLL Search Order Hijacking by DLL Substitution - Modified Metadata
• [Low] Possible multistage attack in Microsoft Teams
• [Low] Possible webshell file written by a web server process

  • [Low] Possible webshell file written by a web server process with connections from various sources and high web traffic - Modified Logic
• [Low] Potential kubelet impersonation attempt
• [Low] Rare unsigned process execution by scheduled task
• [Low] Remote usage of an AWS service token
• [Low] Remote usage of an Azure Managed Identity token
• [Low] Risk indicators detected in email
• [Informational] SSH authentication brute force attempts

  • [Low] Successful SSH Brute Force - Removed
  • [Low] Successful SSH Brute Force - Added
• [Low] SSO authentication attempt by a honey user
• [Low] Sending unusual file(s) to an external address
• [Low] Suspicious EBS snapshots deletion
• [Low] Suspicious access to Kubernetes API with kubelet credentials
• [Low] Suspicious activity on logging bucket
• [Low] Suspicious identity downloaded multiple objects from a bucket
• [Low] Uncommon ARP cache listing via arp.exe
• [Low] Uncommon local scheduled task creation via schtasks.exe
• [Low] Uncommon remote monitoring and management tool
• [Low] Uncommon remote scheduled task creation
• [Low] VPN login attempt by a honey user
• [Low -> Informational] Windows event logs were cleared with PowerShell

  • [Low] Windows event logs were cleared with uncommon PowerShell command line - Added
• [Informational] A Kubernetes ConfigMap was created or deleted
• [Informational] A Kubernetes Cronjob was created
• [Informational] A Kubernetes cluster role binding was created or deleted
• [Informational] A Kubernetes cluster was created or deleted
• [Informational] A Kubernetes ephemeral container was created
• [Informational] A Kubernetes namespace was created or deleted
• [Informational] A Kubernetes role binding was created or deleted
• [Informational] A Kubernetes secret was created or deleted
• [Informational] A Kubernetes service account was created or deleted
• [Informational] A Kubernetes service was created or deleted
• [Informational] A cloud identity created or modified a security group
• [Informational] A cloud identity executed an API call from an unusual country
• [Informational] A cloud identity invoked IAM related persistence operations
• [Informational] A cloud identity started a Cloud Shell session
• [Informational] A cloud instance was stopped
• [Informational] A cloud snapshot of AWS database or storage was modified or shared
• [Informational] A compute-attached identity executed API calls outside the instance's region
• [Informational] A container registry was created or deleted
• [Informational] A possible risky login to Azure
• [Informational] AWS Backup recovery point deletion
• [Informational] AWS EBS enumeration activity
• [Informational] AWS EBS snapshot deletion
• [Informational] AWS EC2 infrastructure enumeration activity
• [Informational] AWS Flow Logs deletion
• [Informational] AWS Lambda infrastructure enumeration activity
• [Informational] AWS Password Policy Discovery
• [Informational] AWS S3 Buckets enumeration activity
• [Informational] AWS S3 object deletion
• [Informational] AWS SSM parameters discovery
• [Informational] AWS SSM parameters retrieval
• [Informational] AWS Secrets Manager Access
• [Informational] AWS Secrets Manager discovery
• [Informational] AWS Storage Gateway enumeration
• [Informational] AWS Storage Gateway file share enumeration
• [Informational] AWS Transfer Family server created
• [Informational] AWS principals discovery
• [Informational] AWS resource discovery
• [Informational] An Azure Firewall rule collection group was modified or deleted
• [Informational] An Azure Key Vault key was modified
• [Informational] An EBS snapshot block was downloaded
• [Informational] An identity accessed a backup cloud storage
• [Informational] An identity accessed a cloud storage for the first time
• [Informational] An identity accessed cloud storage containing sensitive data
• [Informational] An identity attached an administrative policy to an IAM user or role
• [Informational] An identity created or updated password for an IAM user
• [Informational] An identity initiated a download of multiple cloud objects
• [Informational] An identity performed a suspicious download of multiple cloud storage objects
• [Informational] An uncommon RDP session from a managed host
• [Informational] An unknown account was invited to the AWS organization
• [Informational] An unusual cloud identity was granted permissions to a BigQuery resource
• [Informational] An unusual read activity of cloud object
• [Informational] Authentication method added to an Azure account
• [Informational] Azure AD PIM elevation request
• [Informational] Azure AD account unlock/password reset attempt
• [Informational] Azure Automation Account Creation
• [Informational] Azure Automation Runbook Creation/Modification
• [Informational] Azure Automation Runbook Deletion
• [Informational] Azure Key Vault modification
• [Informational] Azure Resource Group Deletion
• [Informational] Azure Temporary Access Pass (TAP) registered to an account
• [Informational] Azure account creation by a non-standard account
• [Informational] Azure application consent
• [Informational] Azure device code authentication flow used
• [Informational] Azure storage account blob anonymous access is enabled
• [Informational] Azure storage account was publicly shared
• [Informational] BigQuery table or query results exfiltrated to a foreign project
• [Informational] BitLocker key retrieval
• [Informational] Bucket's block public access setting turned off
• [Informational] Bucket's object ownership controls were modified
• [Informational] Cloud access key creation

  • [Informational] Successful access key creation by an unusual identity type - Modified Metadata
  • [Informational] Unusual successful cloud access key creation - Modified Metadata
• [Informational] Cloud compute instance user data script modification
• [Informational] Cloud compute serial console access
• [Informational] Cloud compute volume creation attempt
• [Informational] Cloud email infrastructure enumeration activity
• [Informational] Cloud infrastructure enumeration activity
• [Informational] Cloud instance creation attempt
• [Informational] Cloud instance deletion attempt
• [Informational] Cloud resource logging was disabled
• [Informational] Cloud snapshot created or modified
• [Informational] Cloud user performed multiple actions that were denied
• [Informational] CloudTrail logging deletion
• [Informational] Data encryption was disabled
• [Informational] Deletion of multiple cloud resources
• [Informational] Device Registration Policy modification
• [Informational] EBS volume attachment attempt
• [Informational] EBS volume detachment attempt
• [Informational] EC2 instance Amazon machine image was created
• [Informational] Email attachment with a potentially malicious file extension
• [Informational] Email attachment(s) with potentially malicious MIME type
• [Informational] Email containing a link with an IP address convention was detected
• [Informational] Email containing a redirected link
• [Informational] Email contains URL delivering high-risk file type
• [Informational] Email marked as spam and bulk based on Spam Confidence Level and Bulk Complaint Level values
• [Informational] Email mimics replies or forwards without an actual ongoing conversation
• [Informational] Email was received from an unknown address using a public provider domain
• [Informational] Email with URL shortener detected
• [Informational] External Login Password Spray

  • [Informational] External Login Password Spray from Multiple Source Hosts - Added
• [Informational] External email display name impersonation of internal personnel
• [Informational] External email with a single internal recipient hidden in BCC
• [Informational] External user created a Microsoft Teams conversation with suspicious operations
• [Informational] External user started a Microsoft Teams conversation
• [Informational] First SSO Resource Access in the Organization
• [Informational] First SSO access from ASN for user
• [Informational] First SSO access from ASN in organization
• [Informational] First VPN access from ASN in organization
• [Informational] First-seen email from mailbox owner to external recipient's address in the last 30 days
• [Informational] Foreign account was granted permissions to S3 bucket via resource-based policy
• [Informational] GCP logging sink modification
• [Informational] Globally uncommon IP address by a common process (sha256)
• [Informational] IAM Enumeration sequence
• [Informational] IAM User added to an IAM group
• [Informational] IAM inline policy was added to group
• [Informational] IAM inline policy was added to role
• [Informational] IAM inline policy was added to user
• [Informational] IAM instance profile associations were described
• [Informational] IAM instance profile was associated with EC2 instance
• [Informational] IAM instance profile was created
• [Informational] IAM instance profile was replaced for EC2 instance
• [Informational] IAM instance profiles were listed
• [Informational] IAM policy default version was changed
• [Informational] IAM policy version was created
• [Informational] IAM policy was attached to group
• [Informational] IAM policy was attached to role
• [Informational] IAM role trust policy modification
• [Informational] IAM role was created
• [Informational] IAM role-attached managed policies were listed
• [Informational] Kubernetes cluster events deletion
• [Informational] Kubernetes enumeration activity
• [Informational] Kubernetes network policy modification
• [Informational] Log enumeration via cloud native logging service
• [Informational] Moniker link detected in URL(s)
• [Informational] Multiple failed logins from a single IP
• [Informational] Near-empty email from an external sender
• [Informational] Network sniffing detected in Cloud environment
• [Informational] Numerous emails sent by a single sender to multiple internal recipients
• [Informational] Okta account reset password attempt
• [Informational] Okta account unlock
• [Informational] Okta account unlock by admin
• [Informational] Outbound email contains file-sharing service link sent to external recipient
• [Informational] Owner added to Azure application
• [Informational] Possible DLL Hijack into a Microsoft process

  • [Informational] Possible DLL Side-Loading into a Microsoft process from a suspicious folder - Removed
  • [Informational] Possible DLL Side-Loading into a Microsoft process from a suspicious folder - Added
• [Informational] Potential Okta access limit breach
• [Informational] Potential creation of persistent cloud credentials
• [Informational] Punycode characters detected in URL(s)
• [Informational] Rare NTLM Access By User To Host
• [Informational] Rare scheduled task created
• [Informational] Rarely seen URL(s) within a well-known domain detected in your organization's email
• [Informational] Remote usage of VM Service Account token
• [Informational] Remote usage of an App engine Service Account token
• [Informational] Remote usage of an Azure Service Principal token
• [Informational] Retrieval of cloud compute EC2 instance user data
• [Informational] SSO Brute Force
• [Informational] Serial console access was enabled in AWS account
• [Informational] Storage enumeration activity
• [Informational] Suspicious SSO access from ASN
• [Informational] Uncommon URL domain(s) in your organization detected in email
• [Informational] Uncommon signed process execution by scheduled task
• [Informational] Unpopular domains detected in email URLs for a recipient
• [Informational] Unrecognized internal address (AAD mismatch)
• [Informational] Unrecognized sender address
• [Informational] Unrecognized sender domain
• [Informational] Unusual AWS CLI/SDK activity
• [Informational] Unusual AWS S3 objects deletion
• [Informational] Unusual AWS systems manager activity
• [Informational] Unusual Conditional Access operation for an identity
• [Informational] Unusual Identity and Access Management (IAM) activity
• [Informational] Unusual Kubernetes secret access
• [Informational] Unusual cloud Instance Metadata Service (IMDS) access
• [Informational] Unusual key management activity
• [Informational] Unusual resource modification by newly seen IAM user
• [Informational] Unusual secret management activity
• [Informational] Unusual user-agent for a cloud identity
• [Informational] Unverified domain added to Azure AD
• [Informational] User attempted to connect from a suspicious country
• [Informational] Web server CGO executed an uncommon process
• [Informational] Windows CGO, actor and action processes with anomalous characteristics

Modified Metadata

• [Informational] Suspicious process loads a known PowerShell module

  • [High] Office process loads a known PowerShell DLL - Modified Metadata
• [Informational] Execution of an uncommon process at an early startup stage

  • [Medium -> Low] Execution of an uncommon process at an early startup stage with suspicious characteristics - Modified Metadata
• [Low] Execution of an uncommon process at an early startup stage by Windows system binary

  • [Medium -> Low] Execution of an uncommon process at an early startup stage by Windows system binary with suspicious characteristics - Modified Metadata
• [Informational] Execution of an uncommon process with a local/domain user SID at an early startup stage

  • [Medium -> Low] Execution of an uncommon process with a local/domain user SID at an early startup stage with suspicious characteristics - Modified Metadata
• [Low] Execution of an uncommon process with a local/domain user SID at an early startup stage by Windows system binary

  • [Medium -> Low] Execution of an uncommon process with a local/domain user SID at an early startup stage with a suspicious characteristics by Windows system binary - Modified Metadata
• [Informational] Local group enumeration

  • [Low -> Informational] Local group enumeration using a builtin Windows binary - Modified Metadata
• [Informational] Rare DLP rule match by user