2026.03.18

Release date: 13-April-2026

Summary

Added

• 9 Detectors: 1 Medium, 1 Low, 7 Informational
• 15 Variations: 1 High, 2 Medium, 10 Low, 2 Informational

Modified Logic

• 107 Detectors: 4 Medium, 24 Low, 79 Informational
• 17 Variations: 1 Medium, 8 Low, 8 Informational

Modified Metadata

• 6 Detectors: 4 Low, 2 Informational
• 1 Variation: 1 Informational

Added

• [Informational] Uncommon macOS process communication to a rare external host

  • [High] Uncommon macOS process communication to a rare external host by security testing tool
  • [Medium] Uncommon macOS process communication to a rare external host while using a CLI utility to establish a connection with a messaging service API
  • [Medium] Uncommon macOS process communication to a rare external host with a frequently abused TLD
  • [Low] Uncommon macOS process communication to a rare external host related to LOTTunnels
  • [Low] Uncommon macOS process communication to a rare external host while using a CLI utility
  • [Low] Uncommon macOS process communication to a rare external host while using a CLI utility and downloading a script
  • [Low] Uncommon macOS process communication to a rare external host while using a CLI utility and piping to script
  • [Low] Uncommon macOS process communication to a rare external host while using a CLI utility and saving data to a temporary folder
  • [Low] Uncommon macOS process communication to a rare external host while using a CLI utility running by an unsigned process
  • [Low] Uncommon macOS process communication to a rare external host while using a CLI utility to download and change permission
  • [Low] Uncommon macOS process communication to a rare external host with a rare TLD
• [Medium] An unsigned process created scheduled task and performed an injection

  • [Low] Possible an unsigned installer created scheduled task and performed an injection
• [Informational] Invalid SAML Detected

  • [Low] Suspicious Invalid SAML Detected
• [Low] Unusual ADFS Remote Synchronization network connections from non-ADFS server
• [Informational] A GCP Cloud SQL DB instance was exported from a production account
• [Informational] An AWS EC2 instance was exported from a production account
• [Informational] An AWS EC2 instance was exported into an unknown S3 bucket
• [Informational] An RDS snapshot was exported from a production account
• [Informational] An uncommon lolbin execution by scheduled task

  • [Informational] A rare and commonly-abused lolbin execution by scheduled task
  • [Informational] An uncommon lolbin execution by scheduled task on a sensitive server

Modified Logic

• [Low] A user uploaded malware to SharePoint or OneDrive

  • [Medium] A user uploaded malware to SharePoint or OneDrive with suspicious characteristics - Modified Logic
• [Medium] An internal Cloud resource performed port scan on external networks
• [Medium] Discovery of misconfigured certificate templates using LDAP
• [Medium] Potential Phishing has been detected
• [Medium] Unsigned process injecting into a Windows system binary with no command line
• [Low] A process queried the ADFS database decryption key via LDAP
• [Low] A user attempted to bypass Okta MFA
• [Low] Discovery of accounts with pre-authentication disabled via LDAP
• [Low] Email attachment with Right-to-Left Override Unicode character
• [Informational] Email contains URL delivering high-risk file type

  • [Low] External email with URL delivers blocked file types - Modified Logic
• [Low] Email was received from an unknown sender using a disposable domain
• [Low] Email with file-sharing link containing auto-download parameter
• [Informational] Exchange mailbox delegation permissions added

  • [Low] Addition of Exchange mailbox delegation permissions with suspicious characteristics - Modified Logic
• [Low] Impossible traveler - VPN
• [Low] LDAP AD CS Enumeration via Attack Tool
• [Low] Large Upload (FTP)
• [Low] Large Upload (Generic)
• [Low] Large Upload (HTTPS)
• [Low] Large Upload (SMTP)
• [Informational] Member added to a Windows local security group

  • [Low] User added to the Windows local Administrator group - Modified Logic
• [Low] Office process accessed an unusual .LNK file
• [Low] Possible DLL Search Order Hijacking
• [Informational -> Low] RDP from an unmanaged endpoint in a typically managed subnet
• [Low] Rare Windows Remote Management (WinRM) HTTP Activity
• [Low] Remote service start from an uncommon source
• [Low] Sending unusual file(s) to an external address
• [Low] Suspicious LDAP queries followed by shared folder access
• [Informational] Suspicious SPF Result

  • [Low] Internal domain SPF deviation - Modified Logic
• [Informational] Suspicious Unicode character detected in email

  • [Low] Phishing terms obfuscation using Unicode characters detected in email - Modified Logic
  • [Informational] Multiple suspicious Unicode characters detected in email - Modified Logic
• [Low] Uncommon VNC server communication
• [Low] Uncommon local scheduled task creation via schtasks.exe
• [Low] Unusual process accessed a crypto wallet's files
• [Low] Unusual process accessed a web browser history file
• [Informational] User accessed SaaS resource via anonymous link

  • [Low] External user accessed a sensitive SaaS file via anonymous link - Modified Logic
• [Informational] User moved Exchange sent messages to deleted items

  • [Low] Sensitive Exchange sent messages moved to deleted items from unusual source - Modified Logic
• [Informational] VPN login Brute-Force attempt

  • [Low] Successful VPN Login Brute Force - Modified Logic
• [Informational] A rare DLL, signed by an uncommon vendor, was hijacked into a Microsoft process
• [Informational] A user executed multiple LDAP enumeration queries
• [Informational] A user modified an Okta MFA factor
• [Informational] A user modified an Okta network zone
• [Informational] A user modified an Okta policy rule
• [Informational] A user queried AD CS objects via LDAP
• [Informational] Abnormal Communication to a Rare Domain
• [Informational] Abnormal Recurring Communications to a Rare Domain
• [Informational] AppleScript interpreter dynamic library loaded into a process
• [Informational] DNS resolution to the Palo Alto Networks sinkhole
• [Informational] Download pattern that resembles Peer to Peer traffic
• [Informational] Email attachment with a potentially malicious file extension
• [Informational] Email attachment with multiple extensions
• [Informational] Email attachment(s) with potentially malicious MIME type
• [Informational] Email containing a link with an IP address convention was detected
• [Informational] Email containing a redirected link
• [Informational] Email marked as spam and bulk based on Spam Confidence Level and Bulk Complaint Level values
• [Informational] Email mimics replies or forwards without an actual ongoing conversation
• [Informational] Email was received from an unknown address using a public provider domain
• [Informational] Email with URL shortener detected
• [Informational] Exchange email-hiding inbox rule
• [Informational] External email display name impersonation of internal personnel
• [Informational] External email with a single internal recipient hidden in BCC
• [Informational] First-seen email from mailbox owner to external recipient's address in the last 30 days
• [Informational] Globally uncommon image load from a signed process
• [Informational] Globally uncommon process execution from a signed process
• [Informational] Microsoft Teams application setup policy was modified
• [Informational] Microsoft Teams external communication policy was modified
• [Informational] Moniker link detected in URL(s)
• [Informational] Near-empty email from an external sender

  • [Informational] Blank email with an inline attachment from an external sender - Modified Logic
• [Informational] Numerous emails sent by a single sender to multiple internal recipients
• [Informational] Okta account reset password attempt
• [Informational] Okta account unlock
• [Informational] Okta account unlock by admin
• [Informational] Okta admin privilege assignment
• [Informational] Outbound email contains file-sharing service link sent to external recipient
• [Informational] Outbound email includes an external BCC recipient observed for the first time
• [Informational] Outbound email to an address hosted by a public email service provider
• [Informational] Port Scan
• [Informational] Possible GPO Enumeration
• [Informational] Possible LDAP Enumeration Tool Usage
• [Informational] Possible LDAP Enumeration of Microsoft Configuration Manager
• [Informational] Possible SPN enumeration
• [Informational] Potential Okta access limit breach
• [Informational] Potential spoofing of internal domain spotted
• [Informational] Punycode characters detected in URL(s)
• [Informational] Rare scheduled task created
• [Informational] Rarely seen URL(s) within a well-known domain detected in your organization's email
• [Informational] Sudden spike in outbound email volume
• [Informational] Suspicious DKIM Result
• [Informational] Suspicious DMARC result
• [Informational] Suspicious access to cloud credential files
• [Informational] Uncommon URL domain(s) in your organization detected in email
• [Informational] Unpopular domains detected in email URLs for a recipient
• [Informational] Unrecognized internal address (AAD mismatch)
• [Informational] Unrecognized sender address
• [Informational] Unrecognized sender domain
• [Informational] Unsigned DLL Side-Loading
• [Informational] Unusual attachment volume in outbound emails
• [Informational] Unusual display name in From header
• [Informational] Unusual hostname for the sending mail server in the email headers
• [Informational] Unusual process accessed web browser cookies
• [Informational] Unusual process accessed web browser credentials
• [Informational] Upload pattern that resembles Peer to Peer traffic
• [Informational] Usage of homograph characters detected in an email
• [Informational] Usage of homograph characters detected in an email attachment(s) name
• [Informational] Usage of homograph characters detected in an email's from header
• [Informational] User added a new device to Okta Verify instance
• [Informational] VPN Login Password Spray
• [Informational] Well-known brand in sender headers with header inconsistencies
• [Informational] X-Forefront-Antispam-Report has flagged this email as a potential threat

  • [Informational] X-Forefront-Antispam-Report flagged this email as spam - Modified Logic
  • [Informational] X-Forefront-Antispam-Report has flagged this email as a bulk email - Modified Logic
  • [Informational] X-Forefront-Antispam-Report has flagged this email as impersonating a specific user within the organization - Modified Logic
  • [Informational] X-Forefront-Antispam-Report has flagged this email as impersonating the organization's domain - Modified Logic
  • [Informational] X-Forefront-Antispam-Report has flagged this email as using advanced impersonation techniques - Modified Logic
  • [Informational] X-Forefront-Antispam-Report has strongly flagged this email as spam - Modified Logic

Modified Metadata

• [Low] Interactive at.exe privilege escalation method
• [Low] Rare unsigned process execution by scheduled task
• [Low] Uncommon remote scheduled task creation
• [Low] Unsigned process creates a scheduled task via file access
• [Informational] AWS Security Service Enumeration

  • [Low -> Informational] AWS Multiple Security Services Enumeration - Modified Metadata
• [Informational] Uncommon signed process execution by scheduled task