2026.04.29

Release date: 10-May-2026

Summary

Added

• 1 Detector: 1 Informational
• 1 Variation: 1 Medium

Removed

• 1 Detector: 1 Informational

Modified Logic

• 52 Detectors: 1 Medium, 9 Low, 42 Informational
• 5 Variations: 5 Low

Added

• [Informational] Multiple failed AWS assume role attempts

  • [Medium] Suspicious multiple failed AWS assume role attempts

Removed

• [Informational] AWS S3 object deletion

Modified Logic

• [Medium] Potential Phishing has been detected
• [Low] A commonly abused process connected to a rare cloud resource
• [Informational] AWS CloudTrail has been stopped

  • [Low] AWS CloudTrail has been stopped - Modified Logic
• [Informational] Email contains URL delivering high-risk file type

  • [Low] External email with URL delivers blocked file types - Modified Logic
• [Low] Email was received from an unknown sender using a disposable domain
• [Low] Email with file-sharing link containing auto-download parameter

  • [Low] External email with file-sharing link containing auto-download parameter - Modified Logic
• [Informational] LDAP traffic from non-standard process

  • [Low] LDAP traffic from an injected thread within a non-standard process - Added
  • [Low] LDAP traffic from non-standard process executed under an unsigned causality actor in a commonly abused directory - Added
• [Low] Rare binary connected to a rare cloud resource
• [Low] Rare process created an SSH session to an uncommon cloud resource
• [Low] Unusual process accessed FTP Client credentials
• [Low] Unusual process accessed a crypto wallet's files
• [Low] Unusual process accessed a messaging app's files
• [Low] Unusual process accessed a web browser history file
• [Informational] A process connected to a rare cloud resource
• [Informational] Email attachment with a potentially malicious file extension
• [Informational] Email attachment(s) with potentially malicious MIME type
• [Informational] Email containing a link with an IP address convention was detected
• [Informational] Email containing a redirected link
• [Informational] Email marked as spam and bulk based on Spam Confidence Level and Bulk Complaint Level values
• [Informational] Email mimics replies or forwards without an actual ongoing conversation
• [Informational] Email was received from an unknown address using a public provider domain
• [Informational] Email with URL shortener detected
• [Informational] External email display name impersonation of internal personnel
• [Informational] External email with a single internal recipient hidden in BCC
• [Informational] Near-empty email from an external sender
• [Informational] Numerous emails sent by a single sender to multiple internal recipients
• [Informational] Outbound email contains file-sharing service link sent to external recipient
• [Informational] Potential spoofing of internal domain spotted
• [Informational] Punycode characters detected in URL(s)
• [Informational] Rare process accessed a Keychain file
• [Informational] Rarely seen URL(s) within a well-known domain detected in your organization's email
• [Informational] Sensitive browser credential files accessed by a rare non browser process
• [Informational] Suspicious DKIM Result
• [Informational] Suspicious Unicode character detected in email
• [Informational] Uncommon Linux process communication to a rare external host
• [Informational] Uncommon access to /etc/passwd
• [Informational] Uncommon attempt at discovering a sensitive file
• [Informational] Uncommon attempt at grabbing credentials from a sensitive file
• [Informational] Uncommon macOS process communication to a rare external host
• [Informational] Unpopular domains detected in email URLs for a recipient
• [Informational] Unrecognized sender address
• [Informational] Unrecognized sender domain
• [Informational] Unusual display name in From header
• [Informational] Unusual hostname for the sending mail server in the email headers
• [Informational] Unusual process accessed a macOS notes DB file
• [Informational] Unusual process accessed web browser cookies
• [Informational] Unusual process accessed web browser credentials
• [Informational] Unusual sender IP subnet
• [Informational] Usage of homograph characters detected in an email
• [Informational] Usage of homograph characters detected in an email attachment(s) name
• [Informational] Usage of homograph characters detected in an email's from header
• [Informational] Well-known brand in sender headers with header inconsistencies