2026.06.10
Release date: 23-June-2026
Summary
Added
12 Detectors: 6 Low, 6 Informational
6 Variations: 1 Medium, 3 Low, 2 Informational
Removed
1 Detector: 1 Informational
Modified Logic
85 Detectors: 2 High, 4 Medium, 16 Low, 63 Informational
12 Variations: 2 High, 5 Medium, 3 Low, 2 Informational
Modified Metadata
1 Detector: 1 Informational
Added
[Medium] AI-determined combination of risky alerts under the same actor process: LDAP traffic from non-standard process with SMB traffic from non-standard process
[Informational] Cloud activity from a high-risk IP address
[Low] Cloud activity from an unusual high-risk IP
[Low] Administrative IAM User Created with Credentials
[Informational] Uncommon access to Microsoft Teams cookies files
[Low] Suspicious uncommon access to Microsoft Teams cookies files
[Informational] Suspicious sender exhibiting automated sending patterns
[Informational] Suspicious sender with high-volume automated sending patterns
[Informational] Suspicious sending domain with sender address randomization
[Informational] High-volume sender domain with per-message sender randomization
Removed
[Informational] New process created via a WMI call
Modified Logic
[High] A cloud storage object from a sensitive bucket was copied to a foreign cloud account from a production account - Modified Logic
[High] A mail forwarding rule was configured in Google Workspace to an uncommon domain - Modified Logic
[Medium] An identity successfully enumerated and extracted multiple secrets within the organization - Added
[Medium] An identity successfully extracted multiple secrets within the organization across multiple regions - Removed
[Medium] An identity successfully extracted multiple secrets within the organization across multiple regions - Added
[Medium] An unusual identity successfully extracted multiple secrets within the organization - Removed
[Medium] Potential Phishing has been detected
[Medium] Training simulation email detected
[Informational] Vulnerable certificate template loaded
[Medium] First detection of AD CS ESC vulnerability in certificate template - Modified Logic
[Low] Certificate template vulnerable to AD CS ESC attack - Modified Logic
[Low] Foreign account was granted permissions to S3 bucket containing sensitive information via resource-based policy - Modified Logic
[Informational] Unusual resource access by Azure application
[Low] Suspicious resource access by Azure application - Modified Logic
[Informational] A process is masquerading as a common Microsoft product
[Informational] DLP sensitive data exposed to external users
[Informational] EBS snapshots were created from an EC2 instance
[Medium -> Informational] EBS snapshots were created from an EC2 instance attached one or more volumes with sensitive data - Modified Logic
[Informational] EBS volume attachment attempt
[Medium -> Informational] EBS volume attachment attempt for volume with sensitive data - Modified Logic
[Informational] Email attachment with a potentially malicious file extension
[Informational] Email attachment with multiple extensions
[Informational] Email attachment(s) with potentially malicious MIME type
[Informational] Email containing a redirected link
[Informational] Email contains URL delivering high-risk file type
[Informational] Email with URL shortener detected
[Informational] Exchange compliance search created
[Informational] Exchange email-hiding inbox rule
[Informational] Exchange email-hiding transport rule
[Informational] Exchange inbox forwarding rule configured
[Informational] Exchange mailbox delegation permissions added
[Informational] Exchange mailbox folder permission modification
[Informational] External email display name impersonation of internal personnel
[Informational] External email with a single internal recipient hidden in BCC
[Informational] Google Workspace automation was created
[Informational] Massive file downloads from SaaS service
[Informational] Microsoft 365 DLP policy disabled or removed
[Informational] Moniker link detected in URL(s)
[Informational] Near-empty email from an external sender
[Informational] Potential spoofing of internal domain spotted
[Informational] Punycode characters detected in URL(s)
[Informational] Quarantined email released to recipients
[Informational] Rare DLP rule match by user
[Informational] Rarely seen sender address in the organization
[Informational] Rarely seen sender domain in the organization
[Informational] Security tools detection attempt
[Informational] Sensitive Exchange mail sent to external users
[Informational] Sudden spike in outbound email volume
[Informational] Suspicious DKIM Result
[Informational] Suspicious DMARC result
[Informational] Suspicious SPF Result
[Informational] Suspicious Unicode character detected in email
[Informational] Uncommon URL domain(s) in your organization detected in email
[Informational] Unpopular domains detected in email URLs for a recipient
[Informational] Unrecognized internal address (AAD mismatch)
[Informational] Unusual attachment volume in outbound emails
[Informational] Unusual display name in From header
[Informational] Unusual sender IP subnet
[Informational] Usage of homograph characters detected in an email
[Informational] Usage of homograph characters detected in an email's from header
[Informational] User moved Exchange sent messages to deleted items
[Informational] VM Detection attempt
[Informational] Well-known brand in sender headers with header inconsistencies
Modified Metadata
[Informational] Suspicious theme and sentiment in email
Was this helpful?