2026.05.28
Release date: 15-June-2026
Summary
Added
29 Detectors: 1 High, 13 Low, 15 Informational
20 Variations: 5 Medium, 11 Low, 4 Informational
Modified Logic
67 Detectors: 2 Medium, 13 Low, 52 Informational
45 Variations: 7 Medium, 23 Low, 15 Informational
Modified Metadata
14 Detectors: 5 Low, 9 Informational
19 Variations: 2 Medium, 14 Low, 3 Informational
Added
[Informational] Failed AI model usage from a Tor exit node
[Low] ML artifacts destruction
[Medium] Unusual ML artifacts destruction
[Medium] Possible denial of wallet abusing AI services
[Medium] Suspicious First-Time AI Dataset Download by Identity
[Informational] Suspicious ML Model Download
[Medium] Suspicious First-Time AI Model Download by Identity
[Medium] Suspicious AI Knowledge Base Modification
[Low] AI model discovery
[Informational] AI safeguards deletion attempt
[Low] AI safeguards were successfully deleted
[Informational] AI safeguards were modified
[Low] Unusual modification of AI safeguards
[Informational] AI safeguards were created or modified
[Low] AWS Bedrock model invocation logging was successfully deleted
[Informational] AWS Bedrock model invocation logging deletion by an identity with administrative activity
[Informational] Cloud AI agent was modified
[Low] Unusual modification of AI agent
[Informational] Massive files deletion in Box
[Low] Massive files deletion in Box with suspicious parameters
[Informational] Massive files deletion in Dropbox
[Low] Massive files deletion in Dropbox with suspicious parameters
[Informational] Massive files deletion in Google Drive
[Low] Massive files deletion in Google Drive with suspicious parameters
[Informational] Massive files deletion in Microsoft SharePoint or OneDrive
[Low] Massive files deletion in Microsoft SharePoint or OneDrive with suspicious parameters
[Informational] Modification of the AD FS IdentityServer configuration file
[Low] Suspicious Modification of the AD FS IdentityServer configuration file
[Informational] Port Sweep
[Low] Port Sweep to multiple subnets
[Informational] Possible ConsentFix - OAuth Token Theft Detected
[Low] OAuth Token Theft - Potential Session Hijacking Detected from new ASN
[Informational] Unusual AI dataset modification from an internal IP address
[Informational] An RDS snapshot containing sensitive data was exported
[Informational] Unusual AI model invocation
[Informational] Unusual AWS Bedrock model access request
[Informational] Unusual AWS SageMaker notebook access
Modified Logic
[Informational] Access to sensitive host files from within a Kubernetes pod
[Medium] Access to sensitive host files from within a Kubernetes pod via an interactive shell - Modified Logic
[Medium] Known service display name with uncommon image-path in a suspicious folder - Modified Metadata
[Medium] Potential Phishing has been detected
[Informational] Rare scheduled task created
[Medium] Uncommon remote scheduled task created - Modified Metadata
[Low] Uncommon local scheduled task created - Modified Metadata
[Medium] Suspicious usage of AWS service token - Added
[Low -> Informational] Suspicious activity on logging bucket
[Medium] Suspicious deletion on CloudTrail logging bucket - Added
[Informational -> Medium] Training simulation email detected
[Informational] Unusual Kubernetes service account file read
[Medium] Suspicious Kubernetes service account token read via an interactive shell - Modified Logic
[Informational] Unusual exec into a Kubernetes Pod
[Medium] First time execution into Kubernetes Pod at the cluster-level - Modified Metadata
[Low] Identity executed into Kubernetes Pod for the first time - Modified Metadata
[Low] Identity executed into a Kubernetes Pod for the first time - Modified Metadata
[Low] Identity executed into a Kubernetes namespace for the first time - Modified Metadata
[Informational] Failed exec attempt into a Kubernetes Pod - Added
[Low -> Informational] AWS web ACL deletion
[Low] Successful AWS web ACL deletion by a non-admin identity - Added
[Informational] Azure AD account unlock/password reset attempt
[Low] Azure AD account unlock/successful password reset - Modified Logic
[Informational] Email contains URL delivering high-risk file type
[Low] External email with URL delivers blocked file types - Modified Logic
[Low] External email with file-sharing link containing auto-download parameter - Modified Logic
[Low] An external user created a chat and shortly after sent a link with a newly seen domain name - Modified Metadata
[Low] An external user created a chat then sent a link with a file for the first time via Microsoft Teams - Modified Metadata
[Low] An external user created a chat with a suspicious user or chat name and then sent a link via Microsoft Teams - Modified Metadata
[Low] An external user initiated a Microsoft Teams chat in which a link was shared and a member was removed - Modified Metadata
[Low] An external user initiated a Microsoft Teams chat in which a suspicious link was shared and a member was removed - Modified Metadata
[Informational] An external user created a chat and then sent a link via Microsoft Teams - Modified Metadata
[Informational] An external user created a chat then sent a link via Microsoft Teams - Modified Metadata
[Informational] External user started a Microsoft Teams conversation
[Low] An external user started a conversation in Microsoft Teams with a suspicious user or chat name - Modified Metadata
[Low] An external user started multiple conversations in Microsoft Teams - Modified Metadata
[Low] An external user started multiple conversations in Microsoft Teams with suspicious chat names - Modified Metadata
[Informational] An external user started conversations in Microsoft Teams with many internal users - Modified Metadata
[Informational] External user started a Microsoft Teams conversation and sent a message - Modified Metadata
[Informational] Globally uncommon high entropy process was executed
[Low] Globally uncommon high entropy process was executed by an untrusted CGO - Added
[Low] Large Upload (Generic)
[Informational] Large Upload (Generic) Lower than 100 MB - Added
[Informational] Large Upload (Generic) to a Frequently Used Upload Target - Modified Metadata
[Low] Large Upload (HTTPS)
[Low] Large Upload (HTTPS) to non-standard port - Added
[Informational] Uncommon net localgroup execution
[Low] Uncommon net localgroup execution by an untrusted CGO - Added
[Informational] Uncommon user management via net.exe
[Low] Uncommon user management via net.exe by an untrusted CGO - Added
[Informational] User discovery via WMI query execution
[Low] User discovery via WMI query execution by an unsigned process - Modified Metadata
[Low] User modification via WMIC query execution - Modified Metadata
[Informational] User discovery via WMIC query execution - Modified Metadata
[Low] Windows CGO, actor and action processes with anomalous characteristics by an untrusted CGO - Added
[Informational] A WMI subscriber was created
[Informational] An identity accessed cloud storage containing sensitive data
[Informational] DLP sensitive data exposed to external users
[Informational] Email attachment with a potentially malicious file extension
[Informational] Email attachment(s) with potentially malicious MIME type
[Informational] Email containing a redirected link
[Informational] Email with URL shortener detected
[Informational] External email display name impersonation of internal personnel
[Informational] External email with a single internal recipient hidden in BCC
[Informational] GCP Storage Bucket deletion
[Informational] GCP Storage Bucket containing sensitive data was deleted - Added
[Informational] Google Workspace automation was created
[Informational] Near-empty email from an external sender
[Informational] New process created via a WMI call
[Informational] PKINIT TGT authentication request
[Informational] Port Scan
[Informational] Punycode characters detected in URL(s)
[Informational] Rare DLP rule match by user
[Informational] Rarely seen sender address in the organization
[Informational] Rarely seen sender domain in the organization
[Informational] Suspicious DKIM Result
[Informational] Suspicious DMARC result
[Informational] DMARC deviation from historically compliant domain - Modified Logic
[Informational] DMARC failed with non-enforcing policy - Modified Logic
[Informational] DMARC failure bypassed domain policy - Modified Logic
[Informational] Suspicious SPF Result
[Low -> Informational] Internal domain SPF deviation - Modified Logic
[Low -> Informational] Known domain SPF deviation - Modified Logic
[Informational] Known domain unusual SPF result - Modified Metadata
[Informational] Suspicious Unicode character detected in email
[Informational] System profiling WMI query execution
[Informational] Uncommon recurring rare external host access
[Informational] Unpopular domains detected in email URLs for a recipient
[Informational] Unusual display name in From header
[Informational] Well-known brand in sender headers with header inconsistencies
Modified Metadata
[Informational] Identity assigned an Azure AD Administrator Role
[Medium] Identity assigned an Azure AD Administrator Role by an Application - Modified Metadata
[Medium] Suspicious MFA was disabled for an Azure identity - Modified Metadata
[Informational] MFA was disabled for an Azure identity regularly by the user - Modified Metadata
[Informational] Azure application URI modification
[Low] Suspicious Azure application URI modification - Modified Metadata
[Informational] Cloud snapshot created or modified
[Low] Cloud snapshot was configured for public access - Modified Metadata
[Informational] A recently configured Exchange DKIM signing configuration was disabled - Modified Metadata
[Informational] Recently configured Exchange anti-phish policy disabled or removed - Modified Metadata
[Low] Kubernetes Pod Created with host Inter Process Communications (IPC) namespace for the first time by the identity - Modified Metadata
[Low] Kubernetes Pod Created with host Inter Process Communications (IPC) namespace for the first time in the cluster - Modified Metadata
[Low] Kubernetes Pod Created with host Inter Process Communications (IPC) namespace for the first time in the namespace - Modified Metadata
[Informational] Kubernetes Pod created with host process ID (PID) namespace
[Low] Kubernetes Pod created with host process ID (PID) namespace for the first time by the identity - Modified Metadata
[Low] Kubernetes Pod created with host process ID (PID) namespace for the first time in the cluster - Modified Metadata
[Low] Kubernetes Pod created with host process ID (PID) namespace for the first time in the namespace - Modified Metadata
[Informational] Kubernetes Privileged Pod Creation
[Low] Kubernetes Privileged Pod Creation for the first time by the identity - Modified Metadata
[Low] Kubernetes Privileged Pod Creation for the first time in the cluster - Modified Metadata
[Low] Kubernetes Privileged Pod Creation for the first time in the namespace - Modified Metadata
[Informational] Kubernetes pod creation with host network
[Low] Kubernetes pod creation with host network for the first time by the identity - Modified Metadata
[Low] Kubernetes pod creation with host network for the first time in the cluster - Modified Metadata
[Low] Kubernetes pod creation with host network for the first time in the namespace - Modified Metadata
[Informational] Owner added to Azure application
[Informational] Successful unusual guest user invitation
Was this helpful?