2026.05.06

Release date: 18-May-2026

Summary

Added

• 10 Detectors: 1 High, 1 Low, 8 Informational
• 9 Variations: 1 Medium, 8 Low

Modified Logic

• 208 Detectors: 3 High, 7 Medium, 18 Low, 180 Informational
• 1 Variation: 1 Medium
• Improved scoring logic for customer-defined alerts

Modified Metadata

• 1 Detector: 1 Informational

Added

• [High] Multiple risk indicators for a cloud identity
• [Informational] MFA was disabled for a Google Workspace user

  • [Medium] MFA was disabled for a Google Workspace administrative user
  • [Low] MFA was disabled for a Google Workspace user by a different account for the first time
• [Low] ADFS DKM Key Access
• [Informational] Chrome OS Remote Access policy was modified in Google Workspace

  • [Low] Suspicious Chrome OS Remote Access policy was modified in Google Workspace
• [Informational] Google Workspace automation was created

  • [Low] Google Workspace automation was created for a public document
• [Informational] Google Workspace user authentication information changed

  • [Low] Google Workspace administrative user authentication information changed
  • [Low] Google Workspace user authentication information changed by another account
• [Informational] Large volume of files potentially containing credentials accessed in Google Drive

  • [Low] Possible credential files harvesting in Google Drive
• [Informational] Security object deletion in Google Workspace Admin Console

  • [Low] Security object deletion in Google Workspace Admin Console for the first time
• [Informational] Unknown DLL was added to the AD FS Global Assembly Cache path

  • [Low] Suspicious DLL was added to the AD FS Global Assembly Cache path
• [Informational] Chrome Extension Installed By User

Modified Logic

• [High] Cloud penetration testing tool activity
• [High] Suspicious API call from a Tor exit node
• [High] Suspicious objects encryption in an AWS bucket
• [Medium] A Kubernetes API operation was successfully invoked by an anonymous user
• [Medium] A Kubernetes dashboard service account was used outside the cluster
• [Medium] Kubernetes vulnerability scanning tool usage
• [Medium] Logging was impaired via external encryption key
• [Medium] Potential Phishing has been detected
• [Low] Rare unsigned process execution by scheduled task

  • [Medium] Rare unsigned process execution by scheduled task on a sensitive server - Modified Metadata
• [Medium] Suspicious heavy allocation of compute resources - possible mining activity
• [Medium] Windows LOLBIN executable connected to a rare external host
• [Low] A Command Line Interface (CLI) command was executed from a GCP serverless compute service
• [Low] A Command Line Interface (CLI) command was executed from an AWS serverless compute service
• [Low] AWS Guard-Duty detector deletion
• [Low] AWS web ACL deletion
• [Low] An Azure Firewall policy deletion
• [Low] An S3 replication policy to an unknown bucket was created
• [Low] An identity successfully extracted multiple secrets within the organization
• [Low] Azure Event Hub Deletion
• [Low] Azure Network Watcher Deletion
• [Low] Billing admin role was removed
• [Low] Disable encryption operations
• [Low] GCP IAM deny policy creation
• [Low] GCP sensitive role granted to group
• [Low] Kubernetes pod creation from unknown container image registry
• [Low] Microsoft 365 storage services exfiltration activity
• [Low] Remote usage of an Azure Managed Identity token
• [Low] Suspicious usage of EC2 token
• [Informational] A Kubernetes DaemonSet was created
• [Informational] A Kubernetes Pod was created with a sidecar container
• [Informational] A Kubernetes Pod was deleted
• [Informational] A Kubernetes ReplicaSet was created
• [Informational] A Kubernetes StatefulSet was created
• [Informational] A Kubernetes deployment was created
• [Informational] A Kubernetes node service account activity from external IP
• [Informational] A Kubernetes service account executed an unusual API call
• [Informational] A Kubernetes service account has enumerated its permissions
• [Informational] A New Server was Added to an Azure Active Directory Hybrid Health ADFS Environment
• [Informational] A Service Principal was created in Azure
• [Informational] A cloud storage configuration was modified
• [Informational] A new Azure email domain verification was requested
• [Informational] A user logged in to the AWS console for the first time
• [Informational] AWS CloudTrail modification
• [Informational] AWS CloudWatch log group deletion
• [Informational] AWS CloudWatch log stream deletion
• [Informational] AWS Config Recorder stopped
• [Informational] AWS EBS discovery operation
• [Informational] AWS EC2 discovery operation
• [Informational] AWS EC2 instance exported into S3
• [Informational] AWS IAM account discovery operation
• [Informational] AWS IAM permission groups discovery operation
• [Informational] AWS IAM resource group deletion
• [Informational] AWS Lambda discovery operation
• [Informational] AWS RDS cluster deletion
• [Informational] AWS S3 discovery operation
• [Informational] AWS SES account sending settings modified
• [Informational] AWS SSM send command attempt
• [Informational] AWS STS temporary credentials were generated
• [Informational] AWS SecurityHub findings were modified
• [Informational] AWS config resource deletion
• [Informational] AWS network ACL rule creation
• [Informational] AWS network ACL rule deletion
• [Informational] AWS root account activity
• [Informational] AWS support case creation
• [Informational] AWS user creation
• [Informational] Abnormal Allocation of compute resources in multiple regions
• [Informational] Abnormal SMB scanning activity to multiple hosts
• [Informational] Allocation of multiple cloud compute resources
• [Informational] An AWS EC2 instance was exported from a production account
• [Informational] An AWS EC2 instance was exported into an unknown S3 bucket
• [Informational] An AWS EFS File-share mount was deleted
• [Informational] An AWS EFS file-share was deleted
• [Informational] An AWS EKS cluster was created or deleted
• [Informational] An AWS GuardDuty IP set was created
• [Informational] An AWS Lambda Function was created
• [Informational] An AWS Lambda function was modified
• [Informational] An AWS RDS Global Cluster Deletion
• [Informational] An AWS RDS instance was created from a snapshot
• [Informational] An AWS Route 53 domain was transferred to another AWS account
• [Informational] An AWS S3 bucket configuration was modified
• [Informational] An AWS SAML provider was modified
• [Informational] An AWS SES identity was deleted
• [Informational] An AWS database service master user password was changed
• [Informational] An Azure DNS Zone was modified
• [Informational] An Azure Firewall rule collection group was modified or deleted
• [Informational] An Azure Firewall was modified
• [Informational] An Azure Key Vault key was modified
• [Informational] An Azure Key Vault was modified
• [Informational] An Azure Kubernetes Cluster was created or deleted
• [Informational] An Azure Kubernetes Role or Cluster-Role was modified
• [Informational] An Azure Kubernetes Role-Binding or Cluster-Role-Binding was modified or deleted
• [Informational] An Azure Kubernetes Service Account was modified or deleted
• [Informational] An Azure Network Security Group was modified
• [Informational] An Azure Point-to-Site VPN was modified
• [Informational] An Azure Suppression Rule was created
• [Informational] An Azure VM snapshot SAS URL was generated for export from a production subscription
• [Informational] An Azure VPN Connection was modified
• [Informational] An Azure application reached a throttling API rate
• [Informational] An Azure firewall rule group was modified
• [Informational] An Azure identity performed multiple actions that were denied
• [Informational] An Azure virtual network Device was modified
• [Informational] An Azure virtual network was modified
• [Informational] An Email address was added to AWS SES
• [Informational] An IAM group was created
• [Informational] An identity accessed Azure Kubernetes Secrets
• [Informational] An identity created or updated password for an IAM user
• [Informational] An identity disabled bucket logging
• [Informational] An identity started an AWS SSM session
• [Informational] Attempted Azure application access from unknown tenant
• [Informational] Aurora DB cluster stopped
• [Informational] Azure Automation Account Creation
• [Informational] Azure Automation Runbook Creation/Modification
• [Informational] Azure Automation Runbook Deletion
• [Informational] Azure Automation Webhook creation
• [Informational] Azure Blob Container Access Level Modification
• [Informational] Azure Event Hub Authorization rule creation/modification
• [Informational] Azure Key Vault Secrets were modified
• [Informational] Azure Key Vault modification
• [Informational] Azure Kubernetes events were deleted
• [Informational] Azure Resource Group Deletion
• [Informational] Azure Service principal/Application creation
• [Informational] Azure Storage Account key generated
• [Informational] Azure conditional access policy creation or modification
• [Informational] Azure diagnostic configuration deletion
• [Informational] Azure enumeration activity using Microsoft Graph API
• [Informational] Azure group creation/deletion
• [Informational] Azure mailbox rule creation
• [Informational] Azure storage account cross-tenant object replication was enabled
• [Informational] Azure user creation/deletion
• [Informational] Azure virtual machine commands execution
• [Informational] Cloud Organizational policy was created or modified
• [Informational] Cloud Watch alarm deletion
• [Informational] Cloud email sending was enabled
• [Informational] Cloud email service activity
• [Informational] Cloud identity reached a throttling API rate
• [Informational] Cloud resource logging was disabled
• [Informational] Cloud storage object discovery
• [Informational] Cloud user performed multiple actions that were denied
• [Informational] Credentials were added to Azure application
• [Informational] Denied API call by a Kubernetes service account
• [Informational] EBS snapshots were created from an EC2 instance
• [Informational] EC2 snapshot attribute has been modified
• [Informational] External user invitation to Azure tenant
• [Informational] GCP Firewall Rule Modification
• [Informational] GCP Firewall Rule creation
• [Informational] GCP IAM Role Deletion
• [Informational] GCP IAM Service Account Key Deletion
• [Informational] GCP Logging Bucket Deletion
• [Informational] GCP Pub/Sub Subscription Deletion
• [Informational] GCP Pub/Sub Topic Deletion
• [Informational] GCP Service Account Deletion
• [Informational] GCP Service Account Disable
• [Informational] GCP Service Account creation
• [Informational] GCP Service Account key creation
• [Informational] GCP Storage Bucket Configuration Modification
• [Informational] GCP Storage Bucket Permissions Modification
• [Informational] GCP Storage Bucket deletion
• [Informational] GCP VPC Firewall Rule Deletion
• [Informational] GCP Virtual Private Cloud (VPC) Network Deletion
• [Informational] GCP Virtual Private Network Route Creation
• [Informational] GCP Virtual Private Network Route Deletion
• [Informational] GCP administrative role granted to a cloud identity
• [Informational] GCP logging sink deletion
• [Informational] GCP service account impersonation attempt
• [Informational] GCP set IAM policy activity
• [Informational] Granting Access to an Account
• [Informational] Kubernetes Pod Created With Sensitive Volume
• [Informational] Kubernetes Pod Created with host Inter Process Communications (IPC) namespace
• [Informational] Kubernetes Pod created with host process ID (PID) namespace
• [Informational] Kubernetes Privileged Pod Creation
• [Informational] Kubernetes admission controller activity
• [Informational] Kubernetes pod creation with host network
• [Informational] Kubernetes service account activity outside the cluster
• [Informational] MFA device was removed/deactivated from an IAM user
• [Informational] Mailbox enumeration activity by Azure application
• [Informational] Microsoft OneDrive enumeration activity
• [Informational] Microsoft OneNote enumeration activity
• [Informational] Microsoft SharePoint enumeration activity
• [Informational] Microsoft Teams enumeration activity
• [Informational] Modification or Deletion of an Azure Application Gateway Detected
• [Informational] Multi region enumeration activity
• [Informational] Multiple cloud snapshots export
• [Informational] Multiple failed logins from a single IP
• [Informational] OneDrive file download
• [Informational] OneDrive file upload
• [Informational] OneDrive folder creation
• [Informational] Owner was added to Azure application
• [Informational] Port Scan
• [Informational] Potential spoofing of internal domain spotted
• [Informational] Privileged role used by Azure application
• [Informational] Remote usage of AWS Lambda's role
• [Informational] Remote usage of VM Service Account token
• [Informational] Remote usage of an App engine Service Account token
• [Informational] Remote usage of an Azure Service Principal token
• [Informational] S3 configuration deletion
• [Informational] SES Production Access Requested
• [Informational] Soft delete of cloud storage configuration was disabled
• [Informational] Suspicious cloud compute instance SSH keys modification attempt
• [Informational] Suspicious secrets dump activity
• [Informational] Uncommon increase in Azure Microsoft Graph API request sizes
• [Informational] Unusual IAM enumeration activity by a non-user Identity
• [Informational] Unusual access to Microsoft 365 storage services
• [Informational] Unusual certificate management activity
• [Informational] Unusual exec into a Kubernetes Pod
• [Informational] Unusual key management activity
• [Informational] Unusual resource access by Azure application
• [Informational] Unusual secret management activity
• [Informational] Upload pattern that resembles Peer to Peer traffic

Modified Metadata

• [Medium -> Informational] Reverse shell using PowerShell