2026.07.08

Release date: 19-July-2026

Summary

Added

• 5 Detectors: 5 Informational
• 1 Variation: 1 Low

Removed

• 1 Detector: 1 Informational

Modified Logic

• 96 Detectors: 2 High, 1 Medium, 3 Low, 90 Informational
• 13 Variations: 1 Medium, 4 Low, 8 Informational

Modified Metadata

• 1 Detector: 1 Informational
• 1 Variation: 1 Informational

Added

• [Informational] Kubernetes secrets enumeration for the first time

  • [Low] Kubernetes secrets enumeration across all namespaces
• [Informational] AWS S3 bucket data retention policy change through S3 Lifecycle rule
• [Informational] Disable AWS audit logs through Event Selectors
• [Informational] Suspicious brand affiliation detected
• [Informational] Unusual URL(s) sent by a brand were observed in the email

Removed

• [Informational] An identity accessed cloud storage containing sensitive data

Modified Logic

• [High] Cloud penetration testing tool activity
• [High] Suspicious API call from a Tor exit node
• [Informational] GCP Storage Bucket deletion

  • [Medium] First time seen deleting a GCP Storage Bucket containing sensitive data - Added
  • [Informational -> Low] GCP Storage Bucket containing sensitive data was deleted - Modified Logic
• [Medium] Potential Phishing has been detected
• [Informational] Cloud snapshot created or modified

  • [Low] Cloud snapshot was configured for public access - Modified Logic
• [Informational] Email contains URL delivering high-risk file type

  • [Low] External email with URL delivers blocked file types - Modified Logic
• [Low] Email was received from an unknown sender using a disposable domain
• [Low] Email with file-sharing link containing auto-download parameter

  • [Low] External email with file-sharing link containing auto-download parameter - Modified Logic
• [Low] Sending unusual file(s) to an external address
• [Informational] A Cloud DB instance was exported to an unknown destination
• [Informational] A GCP Cloud SQL DB instance was exported from a production account
• [Informational] A cloud identity executed an API call from an unusual country
• [Informational] A cloud instance was stopped
• [Informational] A new Azure email domain verification was requested
• [Informational] AWS SES account sending settings modified
• [Informational] AWS SSM send command attempt
• [Informational] AWS user creation
• [Informational] An AWS EC2 instance containing sensitive data was exported
• [Informational] An AWS EC2 instance was exported from a production account
• [Informational] An AWS EC2 instance was exported into an unknown S3 bucket
• [Informational] An AWS SES identity was deleted
• [Informational] An Azure SQL database was exported from a production subscription
• [Informational] An Azure VM snapshot SAS URL was generated for export from a production subscription
• [Informational] An Email address was added to AWS SES
• [Informational] An RDS snapshot containing sensitive data was exported
• [Informational] An RDS snapshot was exported from a production account
• [Informational] An RDS snapshot was exported to an unknown bucket
• [Informational] An identity accessed a backup cloud storage
• [Informational] An identity accessed a cloud storage for the first time
• [Informational] An identity attached an administrative policy to an IAM user or role
• [Informational] An identity created or updated password for an IAM user
• [Informational] An identity initiated a download of multiple cloud objects
• [Informational] An unusual read activity of cloud object
• [Informational] Bucket's block public access setting turned off
• [Informational] Cloud access key creation
• [Informational] Cloud activity from a high-risk IP address
• [Informational] Cloud compute instance user data script modification
• [Informational] Cloud email infrastructure enumeration activity
• [Informational] Cloud email sending was enabled
• [Informational] Cloud email service activity
• [Informational] Cloud instance creation attempt
• [Informational] Cloud user performed multiple actions that were denied
• [Informational] Compute activity in dormant cloud region
• [Informational] Display text URL differs from actual URL
• [Informational] Email attachment with a potentially malicious file extension
• [Informational] Email attachment(s) with potentially malicious MIME type
• [Informational] Email containing a link with an IP address convention was detected
• [Informational] Email containing a redirected link
• [Informational] Email marked as spam and bulk based on Spam Confidence Level and Bulk Complaint Level values
• [Informational] Email mimics replies or forwards without an actual ongoing conversation
• [Informational] Email was received from an unknown address using a public provider domain
• [Informational] Email with URL shortener detected
• [Informational] External email display name impersonation of internal personnel

  • [Informational] External email display name impersonation of internal personnel, using a public provider - Modified Logic
• [Informational] External email with a single internal recipient hidden in BCC
• [Informational] First-seen email from mailbox owner to external recipient's address in the last 30 days
• [Informational] GCP Service Account creation
• [Informational] GCP administrative role granted to a cloud identity
• [Informational] IAM instance profile associations were described
• [Informational] IAM instance profile was associated with EC2 instance
• [Informational] IAM instance profile was created
• [Informational] IAM instance profile was replaced for EC2 instance
• [Informational] IAM policy was attached to role
• [Informational] IAM role was created
• [Informational] IAM role-attached managed policies were listed
• [Informational] Massive files deletion in Box
• [Informational] Massive files deletion in Dropbox
• [Informational] Massive files deletion in Google Drive
• [Informational] Massive files deletion in Microsoft SharePoint or OneDrive
• [Informational] Near-empty email from an external sender
• [Informational] Numerous emails sent by a single sender to multiple internal recipients
• [Informational] Outbound email contains file-sharing service link sent to external recipient
• [Informational] Outbound email includes an external BCC recipient observed for the first time
• [Informational] Outbound email to an address hosted by a public email service provider
• [Informational] Potential spoofing of internal domain spotted
• [Informational] Punycode characters detected in URL(s)
• [Informational] Rarely seen URL(s) within a well-known domain detected in your organization's email
• [Informational] Rarely seen sender address in the organization
• [Informational] Rarely seen sender domain in the organization
• [Informational] SES Production Access Requested
• [Informational] Sudden spike in outbound email volume
• [Informational] Suspicious DKIM Result
• [Informational] Suspicious DMARC result

  • [Informational] DMARC failed with non-enforcing policy - Modified Logic
  • [Informational] DMARC failure bypassed domain policy - Modified Logic
• [Informational] Suspicious SPF Result

  • [Informational] Internal domain SPF deviation - Modified Logic
  • [Informational] Known domain SPF deviation - Modified Logic
  • [Informational] Known domain unusual SPF result - Removed
• [Informational] Suspicious Unicode character detected in email
• [Informational] Suspicious sender exhibiting automated sending patterns
• [Informational] Suspicious sending domain with sender address randomization
• [Informational] Unpopular domains detected in email URLs for a recipient
• [Informational] Unrecognized internal address (AAD mismatch)
• [Informational] Unusual attachment volume in outbound emails
• [Informational] Unusual display name in From header
• [Informational] Unusual file-sharing links for mailbox owner
• [Informational] Unusual hostname for the sending mail server in the email headers
• [Informational] Unusual sender IP subnet

  • [Informational] Unusual sender IP subnet associated with internal sender - Modified Logic
• [Informational] Usage of homograph characters detected in an email attachment(s) name
• [Informational] Well-known brand in sender headers with header inconsistencies
• [Informational] X-Forefront-Antispam-Report has flagged this email as a potential threat

  • [Informational] X-Forefront-Antispam-Report flagged this email as spam - Modified Logic

Modified Metadata

• [Informational] External Login Password Spray

  • [Informational] External Login Password Spray from Multiple Source Hosts - Modified Metadata