2026.04.15

Release date: 28-April-2026

Summary

Added

• 13 Detectors: 1 Low, 12 Informational
• 14 Variations: 1 High, 2 Medium, 9 Low, 2 Informational

Modified Logic

• 72 Detectors: 1 High, 3 Medium, 18 Low, 50 Informational
• 21 Variations: 5 High, 8 Medium, 6 Low, 2 Informational

Modified Metadata

• 34 Detectors: 2 Medium, 4 Low, 28 Informational

Added

• [Informational] Broker Collection Error

  • [High] Broker Collector Critical Error
  • [Medium] Broker Collection Issue
• [Informational] External user call via Microsoft Teams

  • [Medium] A first seen external user with a suspicious name initiated a Microsoft Teams call
  • [Low] An external user with a suspicious name initiated a Microsoft Teams call
• [Informational] Kubelet server communication from a pod

  • [Low] Kubelet server communication from a pod by a first seen process
• [Informational] Quarantined email released to recipients

  • [Low] Repeated quarantine releases from previously quarantined sender
  • [Low] Repeated quarantine releases to mailbox from previously quarantined sender
  • [Low] Repeated quarantine-released emails received by mailbox
• [Informational] SAAS - Email was reported by the user or administrator as a phishing attempt

  • [Low] SAAS - Phishing report with suspicious verdict on an internal user's email
  • [Low] SAAS - Phishing report with with suspicious verdict
• [Informational] Signed process creates a scheduled task via file access

  • [Low] Signed process running from an untrusted directory creates a scheduled task via file access
• [Low] Suspicious cloud user data modification attempt followed by VM restart
• [Informational] Untrusted process contacted LLM API

  • [Low] Untrusted process contacted a rare LLM API
• [Informational] An AWS EC2 instance containing sensitive data was exported
• [Informational] First-time directory sync of an on-premises domain user to an existing cloud account
• [Informational] Training simulation email detected
• [Informational] Unusual multi-region AWS Resource Explorer searches
• [Informational] Unusual sender IP subnet

  • [Informational] Unusual sender IP subnet associated with infrastructure or tunneling services
  • [Informational] Unusual sender IP subnet associated with internal sender

Modified Logic

• [Low] AWS S3 bucket was exposed to public access

  • [High] AWS S3 bucket was exposed to public access containing sensitive information - Modified Logic
• [Informational] Compute activity in dormant cloud region

  • [High] Compute activity in dormant cloud region by a compromised AWS access key - Modified Logic
• [Low] NTDS.dit file written by an uncommon executable

  • [High] NTDS.dit file written by a rare executable to a suspicious path - Modified Logic
• [High] Suspicious objects encryption in an AWS bucket
• [Informational] Unsigned DLL Side-Loading

  • [High] DLL Side-Loading of module bearing an invalid Microsoft signature - Modified Logic
  • [Medium] Unsigned DLL Side-Loading to a signed microsoft process by a rare causality actor - Modified Logic
  • [Low] Unsigned high entropy DLL Side-Loading by untrusted causality actor - Modified Logic
• [Low] Unusual Process Spawned by Nginx in Ingress-Nginx pod

  • [High] Unusual process spawned by ingress-nginx with a critical-severity vulnerability found the workload - Modified Logic
• [Medium] A cloud storage object was copied to a foreign cloud account
• [Low] A process queried the ADFS database decryption key via LDAP

  • [Medium] LDAP query explicitly queried the ADFS database decryption key (DKM key) - Added
  • [Low] LDAP query queried the ADFS database decryption key (DKM key) - Added
• [Informational] An EBS snapshot block was downloaded

  • [Medium] An EBS snapshot block was downloaded from a snapshot with sensitive data - Modified Logic
• [Low] An RDS snapshot was exported to an unknown S3 bucket

  • [Medium] An RDS snapshot was exported to an unknown S3 bucket while the snapshot contains sensitive data - Modified Logic
• [Informational] EBS snapshots were created from an EC2 instance

  • [Medium] EBS snapshots were created from an EC2 instance attached one or more volumes with sensitive data - Modified Logic
• [Informational] EBS volume attachment attempt

  • [Medium] EBS volume attachment attempt for volume with sensitive data - Modified Logic
• [Medium] Potential Phishing has been detected
• [Medium] Script file added to startup-related Registry keys
• [Informational] Unusual cloud Instance Metadata Service (IMDS) access

  • [Low -> Medium] Unusual cloud Instance Metadata Service (IMDS) access from an unusual known Windows scripting process - Modified Logic
  • [Low] Unusual cloud Instance Metadata Service (IMDS) access from an unusual known scripting process - Modified Logic
• [Informational] Unusual user-agent for a cloud identity

  • [Medium] Unusual user-agent for a cloud identity by a compromised AWS access key - Modified Logic
• [Low] A user modified the CA audit policy
• [Low] Data exfiltration from cloud database
• [Low] Email attachment with Right-to-Left Override Unicode character
• [Informational] Email attachment with multiple extensions

  • [Low] Email executable attachment with multiple executable extensions - Modified Logic
  • [Low] Email executable attachment with multiple extensions - Modified Logic
• [Informational] Foreign account was granted permissions to S3 bucket via resource-based policy

  • [Low] Foreign account was granted permissions to S3 bucket containing sensitive information via resource-based policy - Modified Logic
• [Low] Rare unsigned process execution by scheduled task
• [Low] Recurring access to rare domain
• [Low] Recurring rare domain access from an unsigned process
• [Low] Recurring rare domain access to dynamic DNS domain
• [Low] Sending unusual file(s) to an external address
• [Low] Suspicious PowerShell Command Line
• [Low] Suspicious identity downloaded multiple objects from a bucket
• [Low] Suspicious process accessed certificate files
• [Low] Uncommon local scheduled task creation via schtasks.exe
• [Low] Unusual Netsh PortProxy rule
• [Informational] A cloud identity executed an API call from an unusual country
• [Informational] A user accessed multiple time-consuming websites
• [Informational] AWS EBS enumeration activity
• [Informational] AWS EC2 infrastructure enumeration activity
• [Informational] AWS Lambda infrastructure enumeration activity
• [Informational] AWS S3 Buckets enumeration activity
• [Informational] AWS Security Service Enumeration
• [Informational] An identity accessed cloud storage containing sensitive data
• [Informational] An uncommon lolbin execution by scheduled task
• [Informational] An unusual read activity of cloud object
• [Informational] Azure AD account unlock/password reset attempt
• [Informational] Deletion of AD CS certificate database entries
• [Informational] Email attachment with a potentially malicious file extension
• [Informational] Email attachment(s) with potentially malicious MIME type
• [Informational] Email containing a link with an IP address convention was detected
• [Informational] Email containing a redirected link
• [Informational] Email with URL shortener detected
• [Informational] Exchange mailbox folder permission modification
• [Informational] Execution of masqueraded third-party utility
• [Informational] External email display name impersonation of internal personnel
• [Informational] External email with a single internal recipient hidden in BCC
• [Informational] First-seen email from mailbox owner to external recipient's address in the last 30 days

  • [Informational] First-time outbound email from mailbox owner to multiple external recipients without any internal recipients in the last 30 days - Modified Logic
• [Informational] GCP administrative role granted to a cloud identity
• [Informational] Increase in Job-Related Site Visits
• [Informational] Log enumeration via cloud native logging service
• [Informational] Moniker link detected in URL(s)
• [Informational] Multiple failed logins from a single IP
• [Informational] Outbound email to an address hosted by a public email service provider
• [Informational] Punycode characters detected in URL(s)
• [Informational] Rare scheduled task created
• [Informational] Rarely seen URL(s) within a well-known domain detected in your organization's email
• [Informational] Sudden spike in outbound email volume
• [Informational] Uncommon Linux process communication to a rare external host
• [Informational] Uncommon Linux shell command execution
• [Informational] Uncommon URL domain(s) in your organization detected in email
• [Informational] Uncommon recurring rare external host access
• [Informational] Uncommon signed process execution by scheduled task
• [Informational] Unpopular domains detected in email URLs for a recipient
• [Informational] Unrecognized internal address (AAD mismatch)
• [Informational] Unusual attachment volume in outbound emails

  • [Informational] Unusual attachment amount and size in outbound emails - Modified Logic
• [Informational] Usage of homograph characters detected in an email attachment(s) name

Modified Metadata

• [Medium] A mail forwarding rule was configured in Google Workspace
• [Medium] Suspicious Kubernetes pod token access
• [Low] A GCP service account was delegated domain-wide authority in Google Workspace
• [Low] A domain was added to the trusted domains list
• [Low] MFA Disabled for Google Workspace
• [Low] Potential kubelet impersonation attempt
• [Informational] A Google Workspace Role privilege was deleted
• [Informational] A Google Workspace identity created, assigned or modified a role
• [Informational] A Google Workspace identity performed an unusual admin console activity
• [Informational] A Google Workspace identity used the security investigation tool
• [Informational] A Google Workspace service was configured as unrestricted
• [Informational] A Google Workspace user was added to a group
• [Informational] A Google Workspace user was removed from a group
• [Informational] A third-party application was authorized to access the Google Workspace APIs
• [Informational] A third-party application's access to the Google Workspace domain's resources was revoked
• [Informational] Access to Kubernetes CA certificate file
• [Informational] Access to kubelet credentials file
• [Informational] Access to sensitive host files from within a Kubernetes pod
• [Informational] Admin privileges were granted to a Google Workspace user
• [Informational] An app was added to Google Marketplace
• [Informational] An app was added to the Google Workspace trusted OAuth apps list
• [Informational] An app was removed from a blocked list in Google Workspace
• [Informational] Cloud user performed multiple actions that were denied
• [Informational] Data Sharing between GCP and Google Workspace was disabled
• [Informational] External Sharing was turned on for Google Drive
• [Informational] Gmail delegation was turned on for the organization
• [Informational] Gmail routing settings changed
• [Informational] Google Marketplace restrictions were modified
• [Informational] Google Workspace organizational unit was modified
• [Informational] Google Workspace third-party application's security settings were changed
• [Informational] Kubernetes secret enumeration activity
• [Informational] Retrieval of kubelet credentials
• [Informational] Unusual Kubernetes secret access
• [Informational] Unusual Kubernetes service account file read