2026.07.01

Release date: 12-July-2026

Summary

Added

6 Detectors: 3 Low, 3 Informational
10 Variations: 2 Medium, 6 Low, 2 Informational

Modified Logic

92 Detectors: 1 High, 2 Medium, 12 Low, 77 Informational
35 Variations: 4 Medium, 27 Low, 4 Informational

Modified Metadata

31 Detectors: 5 Medium, 11 Low, 15 Informational
2 Variations: 2 Low

Added

[Informational] A Kubernetes cluster role was created
[Medium] Administrative Kubernetes cluster role was created for the first time
[Low] A Kubernetes cluster role was created for the first time by the identity
[Low] A Kubernetes cluster role with administrative permissions was created
[Low] AWS Lambda Cross-Account sensitive permissions configured
[Medium] AWS Lambda public sensitive permissions configured
[Low] AWS Lambda public permissions configured
[Informational] AWS Lambda Cross-Account permissions configured
[Informational] AWS Backup vault was deleted
[Low] AWS Backup vault was deleted for the first time by this identity
[Low] AWS Backup vault was deleted from a production account
[Low] AWS IAM Role Created with Cross-Account Access
[Informational] AWS IAM Role Created with Cross-Account Access using CloudFormation
[Low] AWS IAM Role's Trusted Policy Modification Allows Cross-Account Access
[Informational] Unusual file-sharing links for mailbox owner
[Low] Unusual file-sharing links for organization

Modified Logic

[High] A successful SSO sign-in from TOR
[Low] Okta FastPass reported phishing attack suspected
[Medium] Okta FastPass reported phishing attack suspected from a suspicious IP - Added
[Medium] Potential Phishing has been detected
[Informational] Rare scheduled task created
[Medium] Uncommon remote scheduled task created - Modified Metadata
[Low] Uncommon local scheduled task created - Modified Metadata
[Low] SSO authentication attempt by a honey user
[Medium] Abnormal SSO authentication by a honey user - Modified Logic
[Low] SSO authentication by a machine account
[Medium] SSO authentication by a machine account from a suspicious IP - Added
[Medium] Training simulation email detected
[Informational] A disabled user attempted to authenticate via SSO
[Low] A disabled user attempted to authenticate via SSO from a suspicious IP - Added
[Informational] A possible risky login to Azure
[Low] Azure Risky Login with Suspicious Characteristics - Modified Logic
[Informational] A user connected from a new country
[Low] A user connected from a new country - suspicious characteristics detected - Modified Logic
[Low] A user connected from a new country via a suspicious IP - Added
[Low] A user rejected an SSO request from an unusual country
[Low] Authentication attempt by a honey user
[Low] Email attachment with Right-to-Left Override Unicode character
[Informational] Email contains URL delivering high-risk file type
[Low] External email with URL delivers blocked file types - Modified Logic
[Low] Email was received from an unknown sender using a disposable domain
[Low] Email with file-sharing link containing auto-download parameter
[Low] External email with file-sharing link containing auto-download parameter - Modified Logic
[Informational] External user created a Microsoft Teams conversation with suspicious operations
[Low] An external user created a chat and shortly after sent a link with a newly seen domain name - Modified Metadata
[Low] An external user created a chat then sent a link with a file for the first time via Microsoft Teams - Modified Metadata
[Low] An external user created a chat with a suspicious user or chat name and then sent a link via Microsoft Teams - Modified Metadata
[Low] An external user initiated a Microsoft Teams chat in which a link was shared and a member was removed - Modified Metadata
[Low] An external user initiated a Microsoft Teams chat in which a suspicious link was shared and a member was removed - Modified Metadata
[Low] External user created a Microsoft Teams conversation with a suspicious user or chat name and shortly after removed a user from it - Modified Metadata
[Informational] An external user created a chat and then sent a link via Microsoft Teams - Modified Metadata
[Informational] An external user created a chat then sent a link via Microsoft Teams - Modified Metadata
[Informational] External user created a Microsoft Teams conversation and shortly after removed a user from it - Modified Metadata
[Informational] First SSO Resource Access in the Organization
[Low] Abnormal first access to a resource via SSO in the organization - Modified Logic
[Informational] First SSO access from ASN for user
[Low] First SSO access from ASN for user - suspicious characteristics detected - Modified Logic
[Informational] First SSO access from ASN in organization
[Low] First SSO access from ASN in organization via a suspicious IP - Added
[Low] First successful SSO access from ASN in the organization - Modified Metadata
[Informational] First connection from a country in organization
[Low] First connection from a country in organization via a suspicious IP - Added
[Informational] First successful SSO connection from a country in organization - Modified Logic
[Low] Impossible traveler - SSO
[Informational] Massive file downloads from SaaS service
[Low] Massive code file downloads from SaaS service - Modified Metadata
[Low] Massive file downloads from SaaS service by terminated user - Modified Metadata
[Low] Suspicious SaaS service file downloads - Modified Metadata
[Low] Possible phishing attack via Microsoft Teams
[Low] SSO authentication by a service account
[Low] SSO authentication by a service account via a suspicious IP - Added
[Informational] SSO with abnormal user agent
[Low] SSO with an offensive user agent - Modified Metadata
[Low] Sending unusual file(s) to an external address
[Informational] Suspicious Azure AD interactive sign-in using PowerShell
[Low] Unusual Azure AD interactive sign-in using PowerShell - Modified Logic
[Informational] Suspicious SSO access from ASN
[Low] Suspicious SSO access from ASN via a suspicious IP - Added
[Informational] User attempted to connect from a suspicious country
[Low] User attempted to connect from a suspicious country via a suspicious IP - Added
[Low] User successfully connected from a suspicious country - Modified Logic
[Informational] A user accessed multiple unusual resources via SSO
[Informational] A user logged in at an unusual time via SSO
[Informational] Azure virtual machine commands execution
[Informational] Cloud instance creation attempt
[Informational] Display text URL differs from actual URL
[Informational] Email attachment with a potentially malicious file extension
[Informational] Email attachment with multiple extensions
[Informational] Email attachment(s) with potentially malicious MIME type
[Informational] Email containing a link with an IP address convention was detected
[Informational] Email containing a redirected link
[Informational] Email marked as spam and bulk based on Spam Confidence Level and Bulk Complaint Level values
[Informational] Email mimics replies or forwards without an actual ongoing conversation
[Informational] Email was received from an unknown address using a public provider domain
[Informational] Email with URL shortener detected
[Informational] External email display name impersonation of internal personnel
[Informational] External email with a single internal recipient hidden in BCC
[Informational] First-seen email from mailbox owner to external recipient's address in the last 30 days
[Informational] IP Rotation Pattern in SSO Spray
[Informational] Intense SSO failures
[Informational] Invalid SAML Detected
[Informational] Massive files deletion in Box
[Informational] Massive files deletion in Dropbox
[Informational] Massive files deletion in Google Drive
[Informational] Massive files deletion in Microsoft SharePoint or OneDrive
[Informational] Moniker link detected in URL(s)
[Informational] Multiple Okta MFA requests sent to a user
[Informational] Near-empty email from an external sender
[Informational] Numerous emails sent by a single sender to multiple internal recipients
[Informational] Outbound email contains file-sharing service link sent to external recipient
[Informational] Outbound email includes an external BCC recipient observed for the first time
[Informational] Outbound email to an address hosted by a public email service provider
[Informational] Possible Impossible Travel Pattern - SSO
[Informational] Potential spoofing of internal domain spotted
[Informational] Punycode characters detected in URL(s)
[Informational] Quarantined email released to recipients
[Informational] Rarely seen URL(s) within a well-known domain detected in your organization's email
[Informational] Rarely seen sender address in the organization
[Informational] Rarely seen sender domain in the organization
[Informational] SSO Brute Force
[Informational] SSO Password Spray
[Informational] SSO with abnormal operating system
[Informational] SSO with new operating system
[Informational] Sudden spike in outbound email volume
[Informational] Suspicious DKIM Result
[Informational] Suspicious DMARC result
[Informational] Suspicious SPF Result
[Informational] Suspicious SSO authentication
[Informational] Suspicious Unicode character detected in email
[Informational] Suspicious sender exhibiting automated sending patterns
[Informational] Suspicious sending domain with sender address randomization
[Informational] Uncommon URL domain(s) in your organization detected in email
[Informational] Unpopular domains detected in email URLs for a recipient
[Informational] Unrecognized internal address (AAD mismatch)
[Informational] Unusual attachment volume in outbound emails
[Informational] Unusual display name in From header
[Informational] Unusual hostname for the sending mail server in the email headers
[Informational] Unusual sender IP subnet
[Informational] Usage of homograph characters detected in an email
[Informational] Usage of homograph characters detected in an email attachment(s) name
[Informational] Usage of homograph characters detected in an email's from header
[Informational] Well-known brand in sender headers with header inconsistencies
[Informational] X-Forefront-Antispam-Report has flagged this email as a potential threat

Modified Metadata

[Medium] Possible code downloading from a remote host by Regsvr32
[Medium] PowerShell suspicious flags
[Medium] Rundll32.exe running with no command-line arguments
[Medium] Rundll32.exe spawns conhost.exe
[Medium] Suspicious certutil command line
[Low] A user uploaded malware to SharePoint or OneDrive
[Low] Cached credentials discovery with cmdkey
[Low] Conhost.exe spawned a suspicious cmd process
[Low] Execution of dllhost.exe with an empty command line
[Low] Mshta.exe launched with suspicious arguments
[Low] Mshta.exe spawns from a browser process
[Informational] Possible Kerberos User Enumeration
[Low] Possible Kerberos User Enumeration Involving Exposed Users - Modified Metadata
[Low] Rundll32.exe executes a rare unsigned module
[Informational] SAAS - Email was reported by the user or administrator as a phishing attempt
[Low] SAAS - Phishing report with suspicious verdict on internal domain sender - Modified Metadata
[Low] Uncommon msiexec execution of an arbitrary file from a remote location
[Low] Unusual Lolbins Process Spawned by InstallUtil.exe
[Low] Unusual Netsh PortProxy rule
[Low] Wscript/Cscript loads .NET DLLs
[Informational] A user accessed an abnormal number of files on a remote shared folder
[Informational] A user accessed an abnormal number of remote shared folders
[Informational] A user performed suspiciously massive file activity
[Informational] DLP sensitive data exposed to external users
[Informational] DSC (Desired State Configuration) lateral movement using PowerShell
[Informational] External SaaS file-sharing activity
[Informational] LOLBIN created a PSScriptPolicyTest PowerShell script file
[Informational] Large volume of files potentially containing credentials accessed in Google Drive
[Informational] MSI accessed a web page running a server-side script
[Informational] Massive file activity abnormal to process
[Informational] Massive upload to SaaS service
[Informational] Massive upload to a rare storage or mail domain
[Informational] Msiexec execution of an executable from an uncommon remote location

Previous2026.07.08

Next2026.06.10

Was this helpful?