2026.08.05

Release date: 16-August-2026

Summary

Added

• 10 Detectors: 1 High, 1 Medium, 6 Low, 2 Informational
• 13 Variations: 4 High, 5 Medium, 3 Low, 1 Informational

Modified Logic

• 34 Detectors: 2 Medium, 9 Low, 23 Informational
• 11 Variations: 1 High, 1 Medium, 9 Low

Modified Metadata

• 2 Detectors: 2 Informational

Temporarily Removed

• 1 Detector: 1 Informational
• 2 Variations: 2 Low

Added

• [Low] Uncommon AppleScript containing a potential defense-evasion command was executed via the command line

  • [High] Uncommon AppleScript containing a potential defense-evasion command was executed via the command line disabling the Gatekeeper security feature
  • [Medium] Uncommon AppleScript containing a potential defense-evasion command was executed via the command line manipulating the 'hosts' file
  • [Low] Uncommon AppleScript containing a potential defense-evasion command was executed via the command line deleting attributes from a file
  • [Low] Uncommon AppleScript containing a potential defense-evasion command was executed via the command line setting a network proxy
• [Low] Uncommon AppleScript containing a potential obfuscation technique was executed

  • [High] Uncommon AppleScript containing a potential obfuscation technique was executed by an uncommon parent process
  • [Medium] Uncommon AppleScript containing a potential obfuscation technique was executed subsequently running a shell command
• [Low] Uncommon AppleScript containing a potential system information discovery command was executed via the command line

  • [High] Uncommon AppleScript containing a potential system information discovery command was executed via the command line querying virtual environment information
  • [Medium] Uncommon AppleScript containing a potential system information discovery command was executed via the command line, querying hardware or software information
• [High] Uncommon AppleScript designed to access sensitive application data was executed via the command line
• [Low] Uncommon AppleScript potentially utilizes credential-grabbing techniques to steal user passwords

  • [High] Uncommon AppleScript potentially utilizes credential-grabbing techniques to steal user passwords leveraging the 'dscl -authonly' command to covertly verify the captured password
• [Medium] Uncommon AppleScript designed to access credential files was executed via the command line
• [Informational] Uncommon AppleScript designed to access cryptocurrency wallet data was executed via the command line

  • [Medium] Uncommon AppleScript designed to access cryptocurrency wallet data was executed via the command line accessed crypto wallet's files
• [Low] Uncommon AppleScript was executed via the command line to contact an external server

  • [Medium] Uncommon AppleScript was executed via the command line to contact an external server using 'curl' to transfer a .zip file
  • [Low] Uncommon AppleScript was executed via the command line to contact an external server using 'curl' to upload a file
• [Low] Uncommon AppleScript designed to capture screen or clipboard data was executed via the command line
• [Informational] Analytics enhanced - Rare Internal Firewall Vulnerability Threat Alert

  • [Informational] Analytics enhanced - Rare Internal Firewall Vulnerability Threat Alert Categorized as code-execution/info-leak

Modified Logic

• [Informational] AppleScript process executed with a rare command line

  • [High] AppleScript process executed with a rare command line containing uncommon arguments - Added
  • [Low] AppleScript process executed with a rare command line that muted the audio output - Added
  • [Low] AppleScript process executed with a rare command line that possibly establishes persistence - Removed
  • [Low] AppleScript process executed with a rare command line that possibly installs a proxy - Removed
• [Medium] Potential Phishing has been detected
• [Informational] Uncommon macOS process communication to a rare external host

  • [Medium] Uncommon macOS process communication to a rare external host involving a code sharing website by a high-risk actor - Added
  • [Low] Uncommon macOS process communication to a rare external host involving a code sharing website - Added
• [Medium] Windows LOLBIN executable connected to a rare external host

  • [Low] Windows LOLBIN executable connected to a rare external host by an RMM CGO - Added
• [Low] A disabled user attempted to log in to a VPN
• [Low] A user rejected an SSO request from an unusual country
• [Low] AWS S3 bucket was exposed to public access
• [Informational] An uncommon RDP session was established

  • [Low] An uncommon RDP session was established by an RMM actor - Added
• [Low] Impossible traveler - VPN
• [Low] Logs were not collected from a data source for an abnormally long time
• [Informational] Rare WinRM Session

  • [Low] Rare WinRM Session by an RMM actor - Added
• [Low] Rare binary connected to a rare external host

  • [Low] Rare binary executing under an RMM CGO connected to a rare external host - Added
• [Low] Suspicious identity downloaded multiple objects from a bucket
• [Informational] Uncommon net localgroup command execution

  • [Low] Uncommon net localgroup command execution by an RMM CGO - Added
• [Low] Unusual process accessed a crypto wallet's files
• [Low] Unusual process accessed a web browser history file
• [Informational] A user connected to a VPN from a new country
• [Informational] An AWS S3 bucket configuration was modified
• [Informational] AppleScript interpreter dynamic library loaded into a process
• [Informational] Bucket's block public access setting turned off
• [Informational] IAM role trust policy modification
• [Informational] Member added to a Windows local security group
• [Informational] S3 configuration deletion
• [Informational] SSO with abnormal operating system
• [Informational] SSO with new operating system
• [Informational] Storage enumeration activity
• [Informational] Suspicious SSO authentication
• [Informational] Unusual process accessed web browser cookies
• [Informational] Unusual process accessed web browser credentials
• [Informational] Unusual sender IP subnet
• [Informational] User attempted to connect from a suspicious country
• [Informational] VPN Login Password Spray
• [Informational] VPN access with an abnormal operating system
• [Informational] VPN login Brute-Force attempt

Modified Metadata

• [Informational] First-time attachment exchange
• [Informational] Initial person-to-person email contact

Temporarily Removed

• [Informational] Slack Connect direct message invite was accepted

  • [Low] Abnormal Slack Connect direct message invite was accepted
  • [Low] Slack Connect direct message invite was accepted from a suspicious external user