2026.07.15
Release date: 26-July-2026
Summary
Added
4 Detectors: 4 Informational
4 Variations: 3 Low, 1 Informational
Modified Logic
25 Detectors: 4 Medium, 3 Low, 18 Informational
8 Variations: 1 High, 1 Medium, 5 Low, 1 Informational
Modified Metadata
10 Detectors: 10 Informational
8 Variations: 3 High, 2 Medium, 3 Low
Added
[Informational] AWS SSM association created with inventory collection document
[Low] Unusual AWS SSM association created with inventory collection document
[Informational] AWS Systems Manager hosts enumeration
[Low] AWS Systems Manager hosts enumeration via programmatic access
[Informational] Impossible travel by a cloud identity
[Low] Impossible travel by an unusual cloud identity
[Informational] Email sent using an automated system or script detected
[Informational] Unusual automated email or script usage detected from a known sender
Modified Logic
[High] Suspicious Kubernetes pod token access via remote access - Added
[Medium] Potential Phishing has been detected
[Informational] Suspicious activity on logging bucket
[Medium] Suspicious deletion on S3 access logs bucket - Added
[Medium] Training simulation email detected
[Informational] Port Sweep
[Low] Port Sweep to multiple subnets - Modified Logic
[Informational] Suspicious Unicode character detected in email
[Low] Phishing terms obfuscation using Unicode characters detected in email - Modified Logic
[Informational] Suspicious access to cloud credential files
[Low] Suspicious access to Windows cloud credential files by an unusual process - Modified Logic
[Low] Suspicious access to cloud credential files by an unusual process - Modified Logic
[Low] Suspicious access to cloud credential files of various cloud providers within a cloud instance - Modified Logic
[Informational] Suspicious access to cloud credential files within a cloud instance - Modified Logic
[Informational] External email display name impersonation of internal personnel
[Informational] IP Rotation Pattern in SSO Spray
[Informational] Intense SSO failures
[Informational] Possible Impossible Travel Pattern - SSO
[Informational] SSO Brute Force
[Informational] SSO Password Spray
[Informational] Suspicious brand affiliation detected
[Informational] Unusual URL(s) sent by a brand were observed in the email
[Informational] VPN Login Password Spray
[Informational] VPN login Brute-Force attempt
[Informational] Well-known brand in sender headers with header inconsistencies
Modified Metadata
[Informational] A cloud identity executed an API call from an unusual country
[High] A cloud identity executed an API call from an unusual country using a compromised AWS access key - Modified Metadata
[Informational] Compute activity in dormant cloud region
[High] Compute activity in dormant cloud region by a compromised AWS access key - Modified Metadata
[Informational] Multiple failed logins from a single IP
[High] Multiple failed logins from a single IP by a compromised AWS access key - Modified Metadata
[Informational] GCP Storage Bucket deletion
[Medium] First time seen deleting a GCP Storage Bucket containing sensitive data - Modified Metadata
[Low] GCP Storage Bucket containing sensitive data was deleted - Modified Metadata
[Informational] Unusual user-agent for a cloud identity
[Medium] Unusual user-agent for a cloud identity by a compromised AWS access key - Modified Metadata
[Informational] EBS snapshots were created from an EC2 instance
[Informational -> Low] EBS snapshots were created from an EC2 instance attached one or more volumes with sensitive data - Modified Metadata
[Informational] EBS volume attachment attempt
[Informational -> Low] EBS volume attachment attempt for volume with sensitive data - Modified Metadata
[Informational] An AWS EC2 instance containing sensitive data was exported
[Informational] An RDS snapshot containing sensitive data was exported
[Low -> Informational] Suspicious PowerShell Enumeration of Running Processes
Was this helpful?