2026.08.26

Release date: 06-September-2026

Summary

Added

• 11 Detectors: 1 Medium, 2 Low, 8 Informational
• 21 Variations: 1 High, 7 Medium, 11 Low, 2 Informational

Removed

• 1 Detector: 1 Informational

Modified Logic

• 180 Detectors: 1 High, 3 Medium, 24 Low, 152 Informational
• 82 Variations: 14 High, 39 Medium, 14 Low, 15 Informational

Modified Metadata

• 365 Detectors: 8 High, 40 Medium, 82 Low, 235 Informational
• 45 Variations: 7 High, 9 Medium, 27 Low, 2 Informational

Added

• [Medium] JS runtime attempted to read Git authentication tokens

  • [High] Uncommon JS runtime attempted to read Git authentication tokens
• [Low] AWS Route53 DNS Resolver query logging configuration deletion

  • [Medium] Successful AWS Route53 DNS Resolver query logging configuration deletion by a non-admin identity
• [Informational] KMS key policy was changed

  • [Medium] KMS key policy was modified to include a foreign principal
  • [Medium] Unusual KMS key policy modification
  • [Low] Failed attempt to change KMS key policy
• [Informational] Multiple alerts associated with a single RDP connection

  • [Medium] Multiple elevated severity alerts associated with a single RDP connection
  • [Low] Diverse alerts associated with a single RDP connection
  • [Low] Multiple alerts associated with a single RDP connection - high risk-processes
  • [Low] Pre-connection activity alongside abnormal RDP connection
• [Informational] Uncommon user management via net command

  • [Medium] Uncommon user management via net command by a renamed lolbin
  • [Medium] Uncommon user management via net command by a web server process or CGO
  • [Medium] Uncommon user management via net command by an untrusted CGO
  • [Low] Uncommon user management via net command by a remote management tool (RMM)
  • [Low] Uncommon user management via net command by an untrusted actor process
• [Informational] Mass deletion of versioned S3 objects

  • [Low] Mass deletion of versioned S3 objects from a bucket containing sensitive data
  • [Low] Mass deletion of versioned S3 objects from a production account
  • [Informational] Mass deletion of versioned S3 objects deviating from the identity baseline
• [Low] Multiple alerts of different MITRE tactics were seen
• [Informational] Multiple mail items were accessed in a short period of time

  • [Low] Multiple mail items were accessed in a short period of time with anomalous properties
• [Informational] Single IP accessed mail items of multiple users

  • [Low] Single IP accessed mail items of multiple users with suspicious characteristics
• [Informational] User mail items accessed from multiple IPs in the same subnet

  • [Low] User mail items accessed from rotating IPs in same subnet with anomalous properties
• [Informational] Uncommon command was executed on a device

  • [Informational] Uncommon sensitive command was executed on a device

Removed

• [Informational] Uncommon user management via net.exe

Modified Logic

• [High] A successful SSO sign-in from TOR
• [Informational] AI-determined combination of risky alerts under the same causality

  • [High] AI-determined combination of risky alerts under the same causality: AD enumeration with AV/FW products enumeration - Added
  • [High] AI-determined combination of risky alerts under the same causality: AD enumeration with MSBuild execution - Added
  • [High] AI-determined combination of risky alerts under the same causality: AD enumeration with shadow copy access - Added
  • [High] AI-determined combination of risky alerts under the same causality: RAR archive creation with password protection and unsigned temp process - Added
  • [High] AI-determined combination of risky alerts under the same causality: active directory enumeration using built in nltest exe, possible arp reconnaissance, unsigned process running from a temporary directory - Added
  • [High] AI-determined combination of risky alerts under the same causality: boot config modification with shadow copy access - Added
  • [High] AI-determined combination of risky alerts under the same causality: file permission changes with boot config modification and unsigned temp process - Added
  • [High] AI-determined combination of risky alerts under the same causality: manipulation of mmc registry configuration, powershell possibly attempting to execute as administrator - Added
  • [High] AI-determined combination of risky alerts under the same causality: mshta exe launched with suspicious arguments, unsigned process running from a temporary directory - Added
  • [High] AI-determined combination of risky alerts under the same causality: new service created via command line, suspicious powershell command line, powershell calling invoke expression argument - Added
  • [High] AI-determined combination of risky alerts under the same causality: powershell running with download in the command line, suspicious powershell command line, powershell calling invoke expression argument - Added
  • [High] AI-determined combination of risky alerts under the same causality: unsigned temp process with WMI shadow copy access - Added
  • [Medium] AI-determined combination of risky alerts under the same causality: AD enumeration with PsExec remote execution and unsigned temp process - Added
  • [Medium] AI-determined combination of risky alerts under the same causality: AD enumeration with Windows Defender manipulation - Added
  • [Medium] AI-determined combination of risky alerts under the same causality: AD enumeration with new service creation and unsigned temp process - Added
  • [Medium] AI-determined combination of risky alerts under the same causality: BootExecute manipulation with shadow copy access - Added
  • [Medium] AI-determined combination of risky alerts under the same causality: Defender manipulation with new service creation and unsigned temp process - Added
  • [Medium] AI-determined combination of risky alerts under the same causality: Defender manipulation with shadow copy access - Added
  • [Medium] AI-determined combination of risky alerts under the same causality: MSBuild execution with boot config modification and unsigned temp process - Added
  • [Medium] AI-determined combination of risky alerts under the same causality: PowerShell download with shadow copy access - Added
  • [Medium] AI-determined combination of risky alerts under the same causality: PowerShell download with suspicious command line and unsigned temp process - Added
  • [Medium] AI-determined combination of risky alerts under the same causality: a scripting engine was called to run in command line, suspicious powershell command line - Added
  • [Medium] AI-determined combination of risky alerts under the same causality: changing permissions or ownership of a file or folder, bitsadmin exe used to download data - Added
  • [Medium] AI-determined combination of risky alerts under the same causality: commonly abused process executed with obfuscated characters, unsigned process running from a temporary directory, manipulation of Windows defender configuration - Added
  • [Medium] AI-determined combination of risky alerts under the same causality: interface enumeration using netsh, possible arp reconnaissance, new service created via command line - Added
  • [Medium] AI-determined combination of risky alerts under the same causality: manipulation of bootexecute registry run key, dumping registry hives with passwords - Added
  • [Medium] AI-determined combination of risky alerts under the same causality: modification of Windows boot configuration using bcdedit exe, execution of regsvcs regasm with uncommon paths - Added
  • [Medium] AI-determined combination of risky alerts under the same causality: modification of Windows boot configuration using bcdedit.exe and msbuild.exe execution - Added
  • [Medium] AI-determined combination of risky alerts under the same causality: new service created via command line, powershell creates a new service - Added
  • [Medium] AI-determined combination of risky alerts under the same causality: new service creation with shadow copy access - Added
  • [Medium] AI-determined combination of risky alerts under the same causality: ping executed with loopback address, msbuild execution, registration of uncommon net services and or assemblies, unsigned process running from a temporary directory - Added
  • [Medium] AI-determined combination of risky alerts under the same causality: ping loopback with PowerShell admin attempt and unsigned temp process - Added
  • [Medium] AI-determined combination of risky alerts under the same causality: ping loopback with shadow copy access - Added
  • [Medium] AI-determined combination of risky alerts under the same causality: powershell running with download in the command line, powershell calling invoke expression argument, query startup programs using wmic exe - Added
  • [Medium] AI-determined combination of risky alerts under the same causality: rundll32 loads a known abused dll, execution of regsvcs regasm with uncommon paths - Added
  • [Medium] AI-determined combination of risky alerts under the same causality: task scheduled by commonly abused host process, a scripting engine was called to run in command line, new service created via command line - Added
  • [Medium] AI-determined combination of risky alerts under the same causality: task scheduled by commonly abused host process, powershell running with download in the command line, msbuild execution - Added
  • [Medium] AI-determined combination of risky alerts under the same causality: task scheduled by commonly abused host process, powershell running with download in the command line, powershell calling invoke expression argument - Added
  • [Medium] AI-determined combination of risky alerts under the same causality: uncommon ip configuration listing via ipconfig exe, uncommon arp cache listing via arp exe, new service created via command line - Added
  • [Medium] AI-determined combination of risky alerts under the same causality: uncommon local scheduled task creation via schtasks exe, suspicious powershell command line - Added
  • [Low] AI-determined combination of risky alerts under the same causality: active directory enumeration using built in nltest exe, powershell running with download in the command line - Added
  • [Low] AI-determined combination of risky alerts under the same causality: active directory enumeration using built in nltest exe, suspicious setspn exe execution - Added
  • [Low] AI-determined combination of risky alerts under the same causality: powershell script executed from a temporary directory, possible arp reconnaissance, unsigned process running from a temporary directory - Added
  • [Low] AI-determined combination of risky alerts under the same causality: suspicious powershell command line, powershell calling invoke expression argument - Added
  • [Low] AI-determined combination of risky alerts under the same causality: suspicious powershell command line, unsigned process running from a temporary directory - Added
  • [Low] AI-determined combination of risky alerts under the same causality: task scheduled by commonly abused host process, commonly abused process executed with obfuscated characters, powershell running with download in the command line, suspicious powershell command line - Added
• [Informational] Msiexec execution of an executable from an uncommon remote location

  • [High] Msiexec execution of an executable from an uncommon remote location by an RMM tool - Added
  • [High] Msiexec execution of an executable from an uncommon remote location with a specific port - Modified Metadata
  • [Medium] Msiexec execution of an executable from an uncommon remote location without properties - Modified Metadata
• [Informational] Access to sensitive host files from within a Kubernetes pod

  • [Medium] Access to sensitive host files from within a Kubernetes pod via an interactive shell - Modified Logic
• [Informational] Exchange email-hiding inbox rule

  • [Medium] Possible BEC Exchange email-hiding inbox rule - Modified Logic
  • [Medium] Suspicious Exchange email-hiding inbox rule - Modified Logic
  • [Medium] Suspicious catch-all Exchange email-hiding inbox rule - Added
  • [Low] Abnormal Exchange email-hiding inbox rule - Modified Logic
• [Informational] Exchange email-hiding transport rule

  • [Medium] Suspicious Exchange email-hiding transport rule - Modified Logic
• [Medium] Kubernetes vulnerability scanning tool usage
• [Medium] New Administrative Behavior
• [Informational] Possible Brute Force in universal authentication

  • [Medium] Brute Force in universal authentication involving a honey user - Modified Metadata
  • [Informational] Abnormal Brute Force in universal authentication - Modified Metadata
• [Informational] Possible Password Spray in universal authentication

  • [Medium] Password Spray in universal authentication involving a honey user - Modified Metadata
• [Medium] Potential Phishing has been detected
• [Low] SSO authentication attempt by a honey user

  • [Medium] Abnormal SSO authentication by a honey user - Modified Logic
• [Informational] Unusual Kubernetes service account file read

  • [Medium] Suspicious Kubernetes service account token read via an interactive shell - Modified Logic
• [Informational] Unusual cloud Instance Metadata Service (IMDS) access

  • [Medium] Unusual cloud Instance Metadata Service (IMDS) access from a lightweight JavaScript runtime executing a script - Added
• [Low] A user rejected an SSO request from an unusual country
• [Low] Abnormal SMB activity to multiple hosts
• [Low] An S3 replication policy to an unknown bucket was created
• [Low] Email attachment with Right-to-Left Override Unicode character
• [Informational] Email contains URL delivering high-risk file type

  • [Low] External email with URL delivers blocked file types - Modified Logic
• [Low] Email was received from an unknown sender using a disposable domain
• [Low] Email with file-sharing link containing auto-download parameter

  • [Low] External email with file-sharing link containing auto-download parameter - Modified Logic
• [Informational] Exchange compliance search created

  • [Low] Suspicious Exchange compliance search created - Modified Logic
• [Low] Executable or Script file written by a web server process
• [Low] Execution of command from within a Kubernetes pod using kubelet credentials
• [Informational] Foreign account was granted permissions to S3 bucket via resource-based policy

  • [Low] Foreign account was granted permissions to S3 bucket via resource-based policy with suspicious indicators - Modified Logic
• [Low] Impossible traveler - SSO
• [Low] Kubernetes pod creation from unknown container image registry
• [Low] Mount command was executed from within a Kubernetes pod to list all the attached filesystems
• [Low] New cloud identity created with administrative policy
• [Informational] Possible Impossible Travel Pattern - SSO

  • [Low] Azure First-Seen Device - Impossible Traveler - Modified Metadata
  • [Low] Rare Country Login - Impossible Traveler (SSO) - Modified Metadata
• [Low] Possible phishing attack via Microsoft Teams
• [Low] Rare SMB session to a remote host
• [Low] SSO authentication by a machine account
• [Low] SSO authentication by a service account
• [Low] Sending unusual file(s) to an external address
• [Informational] Suspicious Unicode character detected in email

  • [Low] Phishing terms obfuscation using Unicode characters detected in email - Modified Logic
• [Low] Suspicious access to Kubernetes API with kubelet credentials
• [Low] Suspicious account attribute modification that matches that of another account
• [Low] Training simulation email detected
• [Low] Unsigned process creates a scheduled task via file access
• [Low] Unusual Kubernetes dashboard communication from a pod
• [Low] Unusual Process Spawned by Nginx in Ingress-Nginx pod
• [Informational] A Kubernetes ConfigMap was created or deleted
• [Informational] A Kubernetes Cronjob was created
• [Informational] A Kubernetes DaemonSet was created
• [Informational] A Kubernetes Pod was created with a sidecar container
• [Informational] A Kubernetes Pod was deleted
• [Informational] A Kubernetes ReplicaSet was created
• [Informational] A Kubernetes StatefulSet was created
• [Informational] A Kubernetes cluster role binding was created or deleted
• [Informational] A Kubernetes cluster role was created
• [Informational] A Kubernetes deployment was created
• [Informational] A Kubernetes ephemeral container was created
• [Informational] A Kubernetes namespace was created or deleted
• [Informational] A Kubernetes node service account activity from external IP
• [Informational] A Kubernetes role binding was created or deleted
• [Informational] A Kubernetes secret was created or deleted
• [Informational] A Kubernetes service account executed an unusual API call
• [Informational] A Kubernetes service account has enumerated its permissions
• [Informational] A Kubernetes service account was created or deleted
• [Informational] A Kubernetes service was created or deleted
• [Informational] A cloud identity invoked IAM related persistence operations
• [Informational] A disabled user attempted to authenticate via SSO
• [Informational] A possible risky login to Azure
• [Informational] A user accessed multiple unusual resources via SSO
• [Informational] A user connected from a new country
• [Informational] A user logged in at an unusual time via SSO
• [Informational] A user logged in to the AWS console for the first time
• [Informational] Abnormal Communication to a Rare Domain
• [Informational] Abnormal Recurring Communications to a Rare Domain
• [Informational] Abnormal connections to a dormant host from a newly seen endpoint
• [Informational] An AWS S3 bucket configuration was modified
• [Informational] An identity disabled bucket logging
• [Informational] An identity started an AWS SSM session
• [Informational] An inactive user attempted to authenticate
• [Informational] Azure Blob Container Access Level Modification
• [Informational] Bucket's block public access setting turned off
• [Informational] Bucket's object ownership controls were modified
• [Informational] Cloud access key creation
• [Informational] Command execution in a Kubernetes pod
• [Informational] Denied API call by a Kubernetes service account
• [Informational] Display text URL differs from actual URL
• [Informational] Email attachment with a potentially malicious file extension
• [Informational] Email attachment with multiple extensions
• [Informational] Email attachment(s) with potentially malicious MIME type
• [Informational] Email containing a link with an IP address convention was detected
• [Informational] Email containing a redirected link
• [Informational] Email marked as spam and bulk based on Spam Confidence Level and Bulk Complaint Level values
• [Informational] Email mimics replies or forwards without an actual ongoing conversation
• [Informational] Email sent using an automated system or script detected
• [Informational] Email was received from an unknown address using a public provider domain
• [Informational] Email with URL shortener detected
• [Informational] External email display name impersonation of internal personnel
• [Informational] External email with a single internal recipient hidden in BCC
• [Informational] First SSO Resource Access in the Organization
• [Informational] First SSO access from ASN for user

  • [Informational] Google Workspace - First SSO access from ASN for user - Modified Logic
• [Informational] First SSO access from ASN in organization

  • [Informational] Google Workspace - First SSO access from ASN in organization - Modified Logic
• [Informational] First connection from a country in organization
• [Informational] First-seen email from mailbox owner to external recipient's address in the last 30 days

  • [Informational] First-time email from mailbox owner to the external recipient's domain in the last 30 days - Modified Logic
  • [Informational] First-time email from organization with the external recipient in the last 30 days - Modified Logic
  • [Informational] First-time email from organization's domain to the external recipient in the last 30 days - Modified Logic
  • [Informational] First-time email from organization's domain with the external recipient's domain in the last 30 days - Modified Logic
  • [Informational] First-time outbound email from mailbox owner to multiple external recipients without any internal recipients in the last 30 days - Modified Logic
• [Informational] First-time attachment exchange
• [Informational] GCP Service Account creation
• [Informational] GCP Storage Bucket Configuration Modification
• [Informational] GCP Storage Bucket Permissions Modification
• [Informational] Globally uncommon image load from a signed process
• [Informational] IAM inline policy was added to role
• [Informational] IAM inline policy was added to user
• [Informational] IAM role was created
• [Informational] IP Rotation Pattern in SSO Spray
• [Informational] Initial person-to-person email contact
• [Informational] Intense SSO failures
• [Informational] Kubelet server communication from a pod
• [Informational] Kubernetes API server communication from within a pod
• [Informational] Kubernetes Pod Created With Sensitive Volume
• [Informational] Kubernetes Pod Created with host Inter Process Communications (IPC) namespace
• [Informational] Kubernetes Pod created with host process ID (PID) namespace
• [Informational] Kubernetes Privileged Pod Creation
• [Informational] Kubernetes admission controller activity
• [Informational] Kubernetes cluster events deletion
• [Informational] Kubernetes environment enumeration activity
• [Informational] Kubernetes network policy modification
• [Informational] Kubernetes nsenter container escape
• [Informational] Kubernetes pod creation with host network
• [Informational] Kubernetes secret enumeration activity
• [Informational] Kubernetes secrets enumeration for the first time
• [Informational] Kubernetes service account activity outside the cluster
• [Informational] Kubernetes version disclosure
• [Informational] MFA device was removed/deactivated from an IAM user
• [Informational] Massive file activity abnormal to process
• [Informational] Moniker link detected in URL(s)
• [Informational] Multiple Okta MFA requests sent to a user
• [Informational] Near-empty email from an external sender
• [Informational] Numerous emails sent by a single sender to multiple internal recipients
• [Informational] Outbound email contains file-sharing service link sent to external recipient
• [Informational] Outbound email includes an external BCC recipient observed for the first time
• [Informational] Outbound email to an address hosted by a public email service provider
• [Informational] Port Scan
• [Informational] Potential spoofing of internal domain spotted
• [Informational] Quarantined email released to recipients
• [Informational] Rarely seen sender address in the organization
• [Informational] Rarely seen sender domain in the organization
• [Informational] Remote code execution into Kubernetes Pod
• [Informational] S3 configuration deletion
• [Informational] SSO Brute Force
• [Informational] SSO Password Spray
• [Informational] SSO with abnormal operating system
• [Informational] SSO with abnormal user agent
• [Informational] SSO with new operating system
• [Informational] Successful universal authentication with suspicious features
• [Informational] Sudden spike in outbound email volume
• [Informational] Suspicious DKIM Result

  • [Informational] DKIM results lacking sender correlation - Modified Metadata
  • [Informational] Known domain DKIM deviation - Modified Metadata
  • [Informational] Known domain suspicious DKIM result - Modified Metadata
  • [Informational] Lack DKIM signature from typically signing domains - Modified Metadata
• [Informational] Suspicious DMARC result
• [Informational] Suspicious SPF Result

  • [Informational] Internal domain SPF deviation - Modified Logic
  • [Informational] Known domain SPF deviation - Modified Metadata
• [Informational] Suspicious SSO access from ASN
• [Informational] Suspicious SSO authentication
• [Informational] Suspicious brand affiliation detected
• [Informational] Suspicious container reconnaissance activity in a Kubernetes pod
• [Informational] Suspicious container runtime connection from within a Kubernetes Pod
• [Informational] Suspicious process execution in a privileged container
• [Informational] Suspicious sender exhibiting automated sending patterns
• [Informational] Suspicious sending domain with sender address randomization
• [Informational] Uncommon URL domain(s) in your organization detected in email
• [Informational] Unrecognized internal address (AAD mismatch)
• [Informational] Unusual Kubernetes secret access
• [Informational] Unusual SSH Activity
• [Informational] Unusual URL(s) sent by a brand were observed in the email
• [Informational] Unusual attachment volume in outbound emails
• [Informational] Unusual certificate management activity
• [Informational] Unusual display name in From header
• [Informational] Unusual exec into a Kubernetes Pod
• [Informational] Unusual file-sharing links for mailbox owner
• [Informational] Unusual hostname for the sending mail server in the email headers
• [Informational] Unusual key management activity
• [Informational] Unusual secret management activity
• [Informational] Unusual sender IP subnet

  • [Informational] Unusual sender IP subnet associated with internal sender - Modified Logic
• [Informational] Usage of homograph characters detected in an email
• [Informational] Usage of homograph characters detected in an email attachment(s) name
• [Informational] Usage of homograph characters detected in an email's from header
• [Informational] User attempted to connect from a suspicious country
• [Informational] Well-known brand in sender headers with header inconsistencies
• [Informational] X-Forefront-Antispam-Report has flagged this email as a potential threat

Modified Metadata

• [Informational] A process connected to a rare external host

  • [High] MSBuild process connected to a rare external host - Modified Metadata
  • [Medium] MSBuild process connected to a rare external host - Modified Metadata
• [High] Bitsadmin.exe used to upload data
• [High] Encoded VBScript executed
• [High] EventLog service disabled by a Registry operation
• [Informational] Globally uncommon IP address by a common process (sha256)

  • [High] Globally uncommon IP address by a common process (sha256) from an injected thread - Modified Metadata
• [Informational] Globally uncommon root-domain port combination by a common process (sha256)

  • [High] Globally uncommon root-domain port combination by a common process (sha256) from an injected thread - Modified Metadata
• [High] Possible Distributed File System Namespace Management (DFSNM) abuse
• [High] Pubprn.vbs signed script proxy execution
• [High] Regsvr32 may have run code from an untrusted source
• [High] Suspicious executable created in a .NET directory
• [Low] Uncommon AppleScript with a potential defense-evasion command was executed via the command line

  • [High] Uncommon AppleScript with a potential defense-evasion command was executed via the command line disabling the Gatekeeper security feature - Modified Metadata
  • [Medium] Uncommon AppleScript with a potential defense-evasion command was executed via the command line manipulating the 'hosts' file - Modified Metadata
  • [Low] Uncommon AppleScript with a potential defense-evasion command was executed via the command line deleting attributes from a file - Modified Metadata
  • [Low] Uncommon AppleScript with a potential defense-evasion command was executed via the command line setting a network proxy - Modified Metadata
• [Low] Uncommon AppleScript with a potential discovery command was executed via the command line

  • [High] Uncommon AppleScript with a potential discovery command was executed via the command line querying virtual environment information - Modified Metadata
  • [Medium] Uncommon AppleScript with a potential discovery command was executed via the command line, querying hardware or software information - Modified Metadata
• [Informational] Uncommon Linux shell command execution

  • [High] Uncommon Linux shell command execution disabling firewall - Modified Metadata
  • [Low] Uncommon Linux shell command execution, possibly granting file execution permissions - Modified Metadata
• [High] Unicode RTL Override Character
• [Low] Unsigned and unpopular process performed an injection

  • [High] Unsigned and unpopular process performed injection into svchost.exe - Modified Metadata
• [Low] A commonly abused process connected to a rare cloud resource

  • [Medium] A commonly abused renamed process connected to a rare cloud resource - Modified Metadata
• [Medium] A process was executed with a command line obfuscated by Unicode character substitution
• [Medium] A suspicious executable with multiple file extensions was created
• [Medium] AMSI Bypass
• [Informational] AWS CloudTrail modification

  • [Medium] AWS CloudTrail modification - Modified Metadata
• [Medium] An unsigned process created scheduled task and performed an injection
• [Medium] Autorun.inf created in root C drive
• [Medium] Azure AD PIM alert disabled
• [Medium] Clear logs - using dd and /dev/null
• [Medium] Delete Volume USN Journal with fsutil
• [Medium] Encoded information using Windows certificate management tool
• [Medium] Executable created to disk by lsass.exe
• [Informational] GCP logging sink modification

  • [Medium] GCP logging sink modification - Modified Metadata
• [Medium] Impersonation using Rubeus tool
• [Medium] Indirect command execution using the Program Compatibility Assistant
• [Medium] Kerberos ticket forging using Impacket ticketer
• [Medium] Logging was impaired via external encryption key
• [Medium] Phantom DLL Loading
• [Medium] Possible code downloading from a remote host by Regsvr32
• [Medium] Possible malicious .NET compilation started by a commonly abused process
• [Medium] Procdump executed from an atypical directory
• [Medium] Process attempts to kill a known security/AV tool
• [Informational] Rare process accessed a Keychain file

  • [Medium] Rare process accessed a Keychain file while installing a new certificate - Modified Metadata
• [Medium] Rundll32.exe launches an executable using ordinal numbers argument
• [Medium] Rundll32.exe running with no command-line arguments
• [Medium] Rundll32.exe spawns conhost.exe
• [Medium] Rundll32.exe was used to run JavaScript
• [Medium] Rundll32.exe with 'main' as EntryPoint
• [Medium] Suspicious .NET process loads an MSBuild DLL
• [Medium] Suspicious DLL load using Control.exe
• [Medium] Suspicious Process Spawned by wininit.exe
• [Medium] Suspicious SearchProtocolHost.exe parent process
• [Medium] Suspicious authentication with Azure Password Hash Sync user
• [Medium] Suspicious certutil command line
• [Medium] Suspicious disablement of the Windows Firewall using PowerShell commands
• [Medium] Suspicious hidden user created
• [Medium] Suspicious process spawns MSBuild.exe
• [Medium] Uncommon DLL-sideloading from a logical CD-ROM (ISO) device
• [Informational] Uncommon macOS process communication to a rare external host

  • [Medium] Uncommon macOS process communication to a rare external host with a frequently abused TLD - Modified Metadata
  • [Low] Uncommon macOS process communication to a rare external host related to LOTTunnels - Modified Metadata
  • [Low] Uncommon macOS process communication to a rare external host while using a CLI utility and downloading a script - Modified Metadata
  • [Low] Uncommon macOS process communication to a rare external host while using a CLI utility and saving data to a temporary folder - Modified Metadata
  • [Low] Uncommon macOS process communication to a rare external host while using a CLI utility running by an unsigned process - Modified Metadata
  • [Low] Uncommon macOS process communication to a rare external host while using a CLI utility to download and change permission - Modified Metadata
  • [Low] Uncommon macOS process communication to a rare external host with a rare TLD - Modified Metadata
• [Medium] Unsigned process injecting into a Windows system binary with no command line
• [Medium] Unusual process access to ld.so.preload file
• [Informational] VM Detection attempt on Linux

  • [Medium] VM Detection attempt on Linux with further reconnaissance commands - Modified Metadata
• [Medium] WerFault ReflectDebugger key set in Registry
• [Medium] Windows event logs cleared using wmic.exe
• [Medium] Windows set to permit unsigned drivers (Test Mode)
• [Medium] WptsExtensions.dll created to disk
• [Low] A compiled HTML help file wrote a script file to the disk
• [Low] A domain was added to the trusted domains list
• [Low] A user modified the CA audit policy
• [Low] AWS Bedrock model invocation logging deletion
• [Low] AWS Guard-Duty detector deletion
• [Low] AWS S3 bucket was exposed to public access
• [Low] AWS Security Group remote access allowed from an unknown external IP address
• [Low] AWS data asset shared public
• [Low] Accessing bash history file
• [Low] Accessing bash history file using bash commands
• [Low] An Azure Firewall policy deletion
• [Low] Azure AD PIM role settings change
• [Low] Azure Event Hub Deletion
• [Low] Azure Network Watcher Deletion
• [Low] Change of sudo caching configuration
• [Low] Conditional Access policy removed
• [Low] Conhost.exe spawned a suspicious cmd process
• [Low] DLL sideloading attack using Xwizard
• [Low] Delayed Deletion of Files
• [Low] Disable Microsoft Defender Antivirus via registry
• [Low] Exchange DKIM signing configuration disabled
• [Low] Exchange Safe Attachment policy disabled or removed
• [Low] Exchange Safe Link policy disabled or removed
• [Low] Exchange anti-phish policy disabled or removed
• [Low] Exchange audit log disabled
• [Low] Exchange mailbox audit bypass
• [Low] Exchange malware filter policy removed
• [Low] Execution of an uncommon process with a local/domain user SID at early startup by a system binary

  • [Low] Execution of an uncommon process with a local/domain user SID at early startup with suspicious characteristics - Modified Metadata
  • [Low] Execution of an uncommon process with a local/domain user SID at early startup with uncommon characteristics - Modified Metadata
  • [Informational] Execution of an uncommon process with a local/domain user SID at early startup by a system binary - Explorer CGO - Modified Metadata
• [Low] Execution of dllhost.exe with an empty command line
• [Low] GCP data asset shared public
• [Informational] Globally uncommon high entropy process was executed

  • [Low] Globally uncommon high entropy process was executed by a web server process or CGO - Modified Metadata
• [Informational] Globally uncommon process execution from a signed process

  • [Low] Globally uncommon process execution from an injected thread in a signed process - Modified Metadata
• [Low] Globally uncommon root domain from a signed process
• [Low] Globally uncommon root-domain port combination from a signed process
• [Low] Linux system firewall was modified
• [Low] MFA was disabled for an Azure identity
• [Low] Machine Account NTLM Relay
• [Low] Masquerading as a default local account
• [Low] Masquerading as the Linux crond process
• [Low] Microsoft Connection Manager Profile Installer loads a file from the users to temporary folder
• [Low] Microsoft Connection Manager Profile Installer makes connections to the network
• [Low] Microsoft Connection Manager Profile Installer runs command line or PowerShell
• [Low] Microsoft Office injects code into a process
• [Low] Mshta.exe launched with suspicious arguments
• [Low] Mshta.exe spawns from a browser process
• [Low] New addition to Windows Defender exclusion list
• [Low] Notepad process makes a network connection
• [Low] Office process spawned with suspicious command-line arguments
• [Low] Possible DCSync from a non domain controller
• [Low] Possible DLL Search Order Hijacking
• [Low] Potential extraction of NAA Account Credentials in Microsoft Configuration Manager
• [Low] Process runs from the recycle bin
• [Low] Rare security product signed executable executed in the network
• [Low] Rare service DLL was added to the registry
• [Low] Rundll32.exe executes a rare unsigned module
• [Low] Scheduled Task hidden by registry modification
• [Low] Scripting engine connected to a rare external host

  • [Low] Scripting engine with a modified image name connected to a rare external host - Modified Metadata
• [Low] Setuid and Setgid file bit manipulation
• [Low] Short-lived user account
• [Low] Suspicious .NET process spawns csc.exe
• [Low] Suspicious AMSI DLL load location
• [Low] Suspicious DotNet log file created
• [Low] Suspicious SSH Downgrade
• [Low] Suspicious data encryption
• [Low] Suspicious disablement of the Windows Firewall
• [Low] Svchost.exe loads a rare unsigned module
• [Low] Tampering with the Windows System Restore configuration
• [Low] The Linux system firewall was disabled
• [Low] Uncommon AppleScript containing a potential obfuscation technique was executed
• [Informational] Uncommon Launch Agent persistency was registered or modified

  • [Low] Uncommon Launch Agent persistency was registered or modified by a non validly signed process - Modified Metadata
  • [Low] Uncommon Launch Agent persistency was registered or modified by an unsigned process - Modified Metadata
  • [Low] Uncommon Launch Agent persistency was registered or modified with an uncommon path containing a known vendor name - Modified Metadata
  • [Low] Uncommon Launch Agent persistency was registered or modified with an unusual persistency executable path - Modified Metadata
• [Informational] Uncommon Launch Daemon persistency was registered or modified

  • [Low] Uncommon Launch Daemon persistency was registered or modified by a non validly signed process - Modified Metadata
  • [Low] Uncommon Launch Daemon persistency was registered or modified by an unsigned process - Modified Metadata
  • [Low] Uncommon Launch Daemon persistency was registered or modified with an uncommon path containing a known vendor name - Modified Metadata
  • [Low] Uncommon Launch Daemon persistency was registered or modified with an unusual persistency executable path - Modified Metadata
• [Informational] Uncommon Linux remote shell command execution

  • [Low] Uncommon Linux remote shell command execution disabling firewall - Modified Metadata
  • [Informational] Uncommon Linux remote shell command execution, possibly granting file execution permissions - Modified Metadata
• [Low] Uncommon NtWriteVirtualMemoryRemote API invocation with a PE header buffer
• [Low] Uncommon attempt to clear shell history
• [Low] Uncommon driver loaded
• [Low] Uncommon execution of ODBCConf
• [Informational] Uncommon login item persistency was registered or modified

  • [Low] Uncommon login item persistency was registered or modified by an invalidly signed actor process - Modified Metadata
  • [Low] Uncommon login item persistency was registered or modified by an invalidly signed causality process - Modified Metadata
• [Informational] Uncommon macOS shell command execution

  • [Low] Uncommon macOS shell command execution from an unsigned process - Modified Metadata
  • [Low] Uncommon macOS shell command execution, possibly granting file execution permissions - Modified Metadata
• [Low] Uncommon msiexec execution of an arbitrary file from a remote location
• [Low] Unsigned and unpopular process performed a DLL injection
• [Low] Unusual Encrypting File System Remote call (EFSRPC) to domain controller
• [Low] Unusual Lolbins Process Spawned by InstallUtil.exe
• [Low] Unusual Netsh PortProxy rule
• [Low] User set insecure CA registry setting for global SANs
• [Low] Wscript/Cscript loads .NET DLLs
• [Informational] A LOLBIN was copied to a different location
• [Informational] A Service Principal was removed from Azure
• [Informational] A browser was opened in private mode
• [Informational] A cloud identity created or modified a security group
• [Informational] A cloud storage configuration was modified
• [Informational] A process is masquerading as a common Microsoft product
• [Informational] A rare DLL, signed by an uncommon vendor, was hijacked into a Microsoft process
• [Informational] A third-party utility was copied to a different location
• [Informational] A user added a Windows firewall rule
• [Informational] A user logged in at an unusual time via VPN
• [Informational] A user modified an Okta network zone
• [Informational] A user modified an Okta policy rule
• [Informational] AI safeguards deletion attempt
• [Informational] AI safeguards were modified
• [Informational] AWS CloudTrail has been stopped
• [Informational] AWS CloudWatch log group deletion
• [Informational] AWS CloudWatch log stream deletion
• [Informational] AWS Config Recorder stopped
• [Informational] AWS Flow Logs deletion
• [Informational] AWS S3 bucket data retention policy change through S3 Lifecycle rule
• [Informational] AWS SecurityHub findings were modified
• [Informational] AWS config resource deletion
• [Informational] AWS network ACL rule deletion
• [Informational] AWS web ACL deletion
• [Informational] Administrator obtains access rights to a file using icacls.exe
• [Informational] An AWS GuardDuty IP set was created
• [Informational] An AWS SAML provider was modified
• [Informational] An Azure Firewall rule collection group was modified or deleted
• [Informational] An Azure Firewall was modified
• [Informational] An Azure Network Security Group was modified
• [Informational] An Azure Point-to-Site VPN was modified
• [Informational] An Azure Suppression Rule was created
• [Informational] An Azure VPN Connection was modified
• [Informational] An Azure firewall rule group was modified
• [Informational] An app was added to the Google Workspace trusted OAuth apps list
• [Informational] An app was removed from a blocked list in Google Workspace
• [Informational] An unusual cloud identity was granted permissions to a BigQuery resource
• [Informational] Authentication Attempt From a Dormant Account
• [Informational] Azure Automation Runbook Deletion
• [Informational] Azure Kubernetes events were deleted
• [Informational] Azure Monitor alert rule deleted
• [Informational] Azure Resource Group Deletion
• [Informational] Azure Temporary Access Pass (TAP) registered to an account
• [Informational] Azure VM extension abuse attempt
• [Informational] Azure application URI modification
• [Informational] Azure application credentials added
• [Informational] Azure application removed
• [Informational] Azure conditional access policy creation or modification
• [Informational] Azure device code authentication flow used
• [Informational] Azure diagnostic configuration deletion
• [Informational] Azure mailbox rule creation
• [Informational] Azure route table creation or modification
• [Informational] Azure storage account blob anonymous access is enabled
• [Informational] Azure storage account was publicly shared
• [Informational] Base64 decoding using the base64 utility
• [Informational] BitLocker key retrieval
• [Informational] Browser downloads an .hta or .application file
• [Informational] Changing permissions or ownership of a file or folder
• [Informational] Chrome OS Remote Access policy was modified in Google Workspace
• [Informational] Chrome launched in Incognito mode
• [Informational] Clear event logging policy using auditpol.exe
• [Informational] Clearing logs by copying /dev/null to a log file
• [Informational] Clearing logs by executing cat /dev/null
• [Informational] Cloud AI agent was modified
• [Informational] Cloud Organizational policy was created or modified
• [Informational] Cloud Watch alarm deletion
• [Informational] Cloud compute volume creation attempt
• [Informational] Cloud instance creation attempt
• [Informational] Cloud instance deletion attempt
• [Informational] Cloud resource logging was disabled
• [Informational] Cloud snapshot created or modified
• [Informational] CloudTrail logging deletion
• [Informational] Common Apple process name missing Apple digital signature
• [Informational] Common Mozilla process name missing Mozilla digital certificate
• [Informational] Common third-party software name masquerading
• [Informational] Commonly abused process executed with obfuscated characters
• [Informational] Commonly abused process spawns out of rundll32.exe
• [Informational] Compiled HTML (help file) makes network connections
• [Informational] Compiler process started by an Office process
• [Informational] Compute activity in dormant cloud region
• [Informational] Data Sharing between GCP and Google Workspace was disabled
• [Informational] Data destruction using sdelete.exe
• [Informational] Data encryption was disabled
• [Informational] Deletion of AD CS certificate database entries
• [Informational] Device Registration Policy modification
• [Informational] Disable AWS audit logs through Event Selectors
• [Informational] Disable outlook security via Registry
• [Informational] Disabling Windows Defender via Registry
• [Informational] Driver written to a temporary directory
• [Informational] EBS volume attachment attempt
• [Informational] EBS volume detachment attempt
• [Informational] Evasion using time-based properties
• [Informational] Executable moved to Windows system folder
• [Informational] Execution of WSL Distro
• [Informational] Execution of commonly abused AutoIT script
• [Informational] Execution of masqueraded third-party utility
• [Informational] Execution of regsvcs/regasm with uncommon paths
• [Informational] Execution of renamed lolbin
• [Informational] Failed Login For Locked-Out Account
• [Informational] File renamed to have a script extension
• [Informational] File timestamp tampering
• [Informational] Fltmc.exe used to unload filter driver
• [Informational] GCP Firewall Rule Modification
• [Informational] GCP Firewall Rule creation
• [Informational] GCP Logging Bucket Deletion
• [Informational] GCP VPC Firewall Rule Deletion
• [Informational] GCP logging sink deletion
• [Informational] Globally uncommon IP address connection from a signed process
• [Informational] Globally uncommon high entropy module was loaded
• [Informational] Globally uncommon injection from a signed process
• [Informational] Hidden Attribute was added to a file using attrib.exe
• [Informational] Hidden directory creation
• [Informational] Hidden file and directory creation
• [Informational] ISO mounted manually
• [Informational] Indicator blocking
• [Informational] Injection into ping.exe
• [Informational] Injection into rundll32.exe
• [Informational] Internet Explorer security settings modification
• [Informational] Iptables configuration command was executed
• [Informational] LOLBAS executable injects into another process
• [Informational] Log deletion in known log file directories
• [Informational] Log deletion using the truncate command
• [Informational] Log deletion via command-line tool
• [Informational] Login by a dormant user
• [Informational] MFA was disabled for a Google Workspace user
• [Informational] MSBuild execution
• [Informational] MSI accessed a web page running a server-side script
• [Informational] MacOS firewall manipulation
• [Informational] Manipulation of Crypto Subject Interface Package (SIP) Provider
• [Informational] Manipulation of Windows Defender configuration
• [Informational] Manipulation of Windows Event Log auto-backup via Registry
• [Informational] Manipulation of service imagepath configuration
• [Informational] Microsoft 365 DLP policy disabled or removed
• [Informational] Microsoft HTML Application Host spawns from CMD or PowerShell
• [Informational] Microsoft HTML Application Host spawns from Explorer.exe
• [Informational] Microsoft Teams application setup policy was modified
• [Informational] Microsoft Teams external communication policy was modified
• [Informational] Modification of PAM
• [Informational] Modification of Windows boot configuration using bcdedit.exe
• [Informational] Modification of the AD FS IdentityServer configuration file
• [Informational] Multi region enumeration activity
• [Informational] NTLM Relay
• [Informational] Netsh.exe modifies allowed firewall port/program lists
• [Informational] New certificate added to the trusted root store
• [Informational] Permissive file privileges were granted
• [Informational] Ping executed with loopback address
• [Informational] Ping to a known external IP address
• [Informational] Ping to localhost from an uncommon, unsigned parent process
• [Informational] Possible DLL Hijack into a Microsoft process
• [Informational] Possible authentication coercion
• [Informational] Possible binary padding using dd
• [Informational] Possible data obfuscation
• [Informational] Possible log destruction using the dd command
• [Informational] Potential DCSync by an unusual user
• [Informational] Potential NTLM Relay Attack
• [Informational] Potential NTLM Relay Attack against a Microsoft Configuration Manager Site Server
• [Informational] PowerShell is used to execute a CPL file
• [Informational] PowerShell is used to modify a timestamp
• [Informational] Punycode characters detected in URL(s)
• [Informational] Rare signature signed executable executed in the network
• [Informational] Registration of Uncommon .NET Services and/or Assemblies
• [Informational] Removal of an Azure Owner from an Application or Service Principal
• [Informational] Root certificate installed
• [Informational] Root certificate installed
• [Informational] Rundll32 loads a known abused DLL
• [Informational] SELinux was set to permissive mode
• [Informational] Scripting engine creates an Alternate Data Stream (ADS)
• [Informational] Security object deletion in Google Workspace Admin Console
• [Informational] Security services stopped
• [Informational] Security tools detection attempt
• [Informational] Shell binary copied to another location
• [Informational] Short-lived Azure AD user account
• [Informational] Signed process performed an unpopular DLL injection
• [Informational] Signed process performed an unpopular injection
• [Informational] SmartScreen disabled via Registry
• [Informational] Space after filename
• [Informational] Space after filename creation
• [Informational] Suspicious AMSI decode attempt
• [Informational] Suspicious activity on logging bucket
• [Informational] Suspicious process accessed a site masquerading as Google
• [Informational] Suspicious process execution from tmp folder
• [Informational] Suspicious usage of cytool.exe
• [Informational] SyncAppvPublishingServer used to run PowerShell code
• [Informational] Tampering with Internet Explorer Protected Mode configuration
• [Informational] Tampering with Windows Control Panel configuration
• [Informational] Tampering with Windows certificate blocking configuration
• [Informational] Tampering with the Windows User Account Controls (UAC) configuration
• [Informational] The scripting engine executed code from an Alternate Data Stream (ADS)
• [Informational] Uncommon DotNet module load relationship
• [Informational] Uncommon kernel module load
• [Informational] Unknown DLL was added to the AD FS Global Assembly Cache path
• [Informational] Unpopular rsync process execution
• [Informational] Unsigned DLL Hijack into a Microsoft process
• [Informational] Unsigned DLL Side-Loading
• [Informational] Unsigned process creates an Alternate Data Stream (ADS)
• [Informational] Unsigned process injects code into a process
• [Informational] Unsigned process running from a temporary directory
• [Informational] Unusual Conditional Access operation for an identity
• [Informational] Unusual cloud identity impersonation
• [Informational] Unusual use of a 'SysInternals' tool
• [Informational] Unusual user-agent for a cloud identity
• [Informational] Usage of tracing tool
• [Informational] User account flagged as hidden
• [Informational] User added SID History to an account
• [Informational] User moved Exchange sent messages to deleted items
• [Informational] VM Detection attempt
• [Informational] VPN login by a dormant user
• [Informational] WMI terminated a process
• [Informational] WSL Feature Installation
• [Informational] Weakly-Encrypted Kerberos TGT Response
• [Informational] Windows 10 Developer Mode enabled
• [Informational] Windows Firewall disabled via Registry
• [Informational] Windows Firewall notifications disabled via Registry
• [Informational] Windows PowerShell Logging being disabled via Registry
• [Informational] Windows Registry Editor being disabled via Registry
• [Informational] Windows Security audit log was cleared
• [Informational] Windows Task Manager being disabled via Registry
• [Informational] Windows event logs were cleared with PowerShell
• [Informational] Windows process masquerading by an unsigned process