2026.07.22
Release date: 03-August-2026
Summary
Added
12 Detectors: 2 Medium, 1 Low, 9 Informational
10 Variations: 1 High, 4 Low, 5 Informational
Removed
2 Detectors: 2 Informational
1 Variation: 1 Informational
Modified Logic
81 Detectors: 3 High, 3 Medium, 14 Low, 61 Informational
27 Variations: 8 Medium, 8 Low, 11 Informational
Added
[Low] Uncommon AppleScript containing a potential persistence command was executed via the command line
[High] Uncommon AppleScript containing a potential persistence command was executed via the command line targeting a .plist file for modification
[Low] Uncommon AppleScript containing a potential persistence command was executed via the command line targeting launchctl load command execution
[Informational] An Azure VM snapshot SAS URL was generated
[Low] An identity generated a SAS URL for an Azure VM snapshot with unusual characteristics
[Informational] Slack Connect direct message invite was accepted
[Low] Abnormal Slack Connect direct message invite was accepted
[Low] Slack Connect direct message invite was accepted from a suspicious external user
[Informational] AWS Bedrock AI infrastructure enumeration activity
[Informational] Suspicious AWS Bedrock AI infrastructure enumeration by an identity with no prior AI activity
[Informational] Azure Monitor alert rule deleted
[Informational] Azure Monitor alert rule deleted by compute workload
[Informational] Unusual Azure Monitor alert rule deletion
[Informational] Azure VM extension abuse attempt
[Informational] Unusual azure VM extension abuse
[Informational] Azure route table creation or modification
[Informational] Unusual Azure route table creation or modification
[Informational] First-time attachment exchange
[Informational] Initial person-to-person email contact
[Informational] Uncommon Azure Cosmos DB master key read by identity
Removed
[Informational] Rarely seen URL(s) within a well-known domain detected in your organization's email
[Informational] Unpopular domains detected in email URLs for a recipient
[Informational] Highly unpopular URL domain(s) for mailbox detected in email
Modified Logic
[Medium] A Successful VPN connection from TOR via Mobile Device - Modified Logic
[Medium] A successful SSO sign-in from TOR via Mobile Device - Modified Logic
[Medium] Suspicious SaaS API call from a Tor exit node via Mobile Device - Modified Logic
[Informational] Possible LDAP Enumeration Tool Usage
[Medium] A user executed an LDAP enumeration query with suspicious characteristics - Modified Metadata
[Low] Rare LDAP enumeration query executed by a user - Modified Logic
[Medium] Possible new DHCP server
[Medium] Potential Phishing has been detected
[Informational] Rare scheduled task created
[Medium] Uncommon remote scheduled task created - Modified Metadata
[Low] Uncommon local scheduled task created - Modified Metadata
[Informational] SSO Brute Force
[Medium] Successful SSO Brute Force Threat Detected - Modified Logic
[Low] SSO Brute Force Activity Observed - Modified Logic
[Medium] Abnormal SSO authentication by a honey user - Modified Logic
[Informational] Signed process performed an unpopular injection
[Medium] Commonly abused signed process performed a globally unpopular injection to a Microsoft signed process - Modified Logic
[Medium] Training simulation email detected
[Informational] Email contains URL delivering high-risk file type
[Low] External email with URL delivers blocked file types - Modified Logic
[Low] External email with file-sharing link containing auto-download parameter - Modified Logic
[Low] Failed Connections
[Informational] First SSO Resource Access in the Organization
[Low] Abnormal first access to a resource via SSO in the organization - Modified Logic
[Informational] Globally uncommon image load from a signed process
[Low] Globally uncommon image load from an injected thread in a signed process - Modified Logic
[Low] SAAS - Phishing report with suspicious verdict on internal domain sender - Modified Logic
[Informational] A cloud storage configuration was modified
[Informational] A process connected to a rare cloud resource
[Informational] A user executed multiple LDAP enumeration queries
[Informational] AppleScript executed a shell script
[Informational] AppleScript interpreter dynamic library loaded into a process
[Informational] Azure virtual machine commands execution
[Informational] Azure managed Run Command (runCommands/write) execution - Added
[Informational] First Azure VM remote command execution on this VM - Added
[Informational] Unusual Azure VM remote command execution - Added
[Informational] Display text URL differs from actual URL
[Informational] Email attachment with a potentially malicious file extension
[Informational] Email attachment(s) with potentially malicious MIME type
[Informational] Email containing a redirected link
[Informational] Email with URL shortener detected
[Informational] Executable moved to Windows system folder
[Informational] External email display name impersonation of internal personnel
[Informational] External email with a single internal recipient hidden in BCC
[Informational] First-seen email from mailbox owner to external recipient's address in the last 30 days
[Informational] First-time email from mailbox owner to the external recipient's domain in the last 30 days - Modified Logic
[Informational] First-time email from organization with the external recipient in the last 30 days - Modified Logic
[Informational] First-time email from organization's domain to the external recipient in the last 30 days - Modified Logic
[Informational] First-time email from organization's domain with the external recipient's domain in the last 30 days - Modified Logic
[Informational] First-time outbound email from mailbox owner to multiple external recipients without any internal recipients in the last 30 days - Modified Logic
[Informational] Globally uncommon IP address by a common process (sha256)
[Informational] Globally uncommon IP address connection from a signed process
[Informational] Invalid SAML Detected
[Informational] Moniker link detected in URL(s)
[Informational] Near-empty email from an external sender
[Informational] Potential spoofing of internal domain spotted
[Informational] Punycode characters detected in URL(s)
[Informational] Quarantined email released to recipients
[Informational] Rarely seen sender address in the organization
[Informational] Rarely seen sender domain in the organization
[Informational] SSO with abnormal operating system
[Informational] Sudden spike in outbound email volume
[Informational] Suspicious DKIM Result
[Informational] Suspicious DMARC result
[Informational] DMARC failure bypassed domain policy - Modified Logic
[Informational] Suspicious SPF Result
[Informational] Internal domain SPF deviation - Modified Logic
[Informational] Suspicious Unicode character detected in email
[Informational] Suspicious brand affiliation detected
[Informational] Suspicious sender exhibiting automated sending patterns
[Informational] Suspicious sending domain with sender address randomization
[Informational] Unrecognized internal address (AAD mismatch)
[Informational] Unusual URL(s) sent by a brand were observed in the email
[Informational] Unusual attachment volume in outbound emails
[Informational] Unusual display name in From header
[Informational] Unusual sender IP subnet
[Informational] Unusual sender IP subnet associated with internal sender - Modified Logic
[Informational] Usage of homograph characters detected in an email
[Informational] Usage of homograph characters detected in an email's from header
[Informational] Well-known brand in sender headers with header inconsistencies
Was this helpful?