2026.04.22

Release date: 03-May-2026

Summary

Added

• 1 Detector: 1 Low

Removed

• 2 Detectors: 1 High, 1 Informational

Modified Logic

• 4 Detectors: 1 Medium, 1 Low, 2 Informational
• 7 Variations: 1 High, 1 Medium, 5 Low

Modified Metadata

• 5 Detectors: 2 Low, 3 Informational

Added

• [Low] Microsoft Office process spawns conhost.exe

Removed

• [High] Microsoft Office process spawns conhost.exe
• [Informational] Autostart Registry key created by a commonly abused process

Modified Logic

• [Low] Uncommon remote scheduled task creation

  • [High] Uncommon remote scheduled task creation by a remote actor via RDP - Added
• [Medium] Potential Phishing has been detected

  • [Medium] Potential Brand Impersonation has been detected - Added
• [Informational] A process is masquerading as a common Microsoft product

  • [Low] A process is masquerading as a common Microsoft Lolbin - Added
  • [Low] A process running from a commonly abused directory is masquerading as a common Microsoft product - Added
• [Low -> Informational] Uncommon local scheduled task creation via schtasks.exe

  • [Low] Uncommon scheduled task created by a signed actor from a rare vendor via schtasks.exe - Added
  • [Low] Uncommon scheduled task created by an unsigned actor via schtasks.exe - Added
  • [Low] Uncommon scheduled task created by an unsigned and rare actor via schtasks.exe - Added

Modified Metadata

• [Low] A process queried the ADFS database decryption key via LDAP
• [Low] Unusual ADFS Remote Synchronization network connections from non-ADFS server
• [Informational] Invalid SAML Detected
• [Informational] Near-empty email from an external sender
• [Informational] Suspicious DKIM Result