> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-09-23.md).

# 2026.09.23

### Release date: 12-October-2026

### Summary

#### Added

* **24 Detectors:** 1 Medium, 3 Low, 20 Informational
* **84 Variations:** 3 Medium, 78 Low, 3 Informational

#### Removed

* **5 Detectors:** 5 Informational

#### Modified Logic

* **382 Detectors:** 7 High, 32 Medium, 131 Low, 212 Informational
* **83 Variations:** 4 High, 27 Medium, 45 Low, 7 Informational

#### Modified Metadata

* **12 Detectors:** 12 Low

#### Temporarily Removed

* **1 Detector:** 1 Informational
* **3 Variations:** 1 Medium, 2 Low

### Added

* \[Low] [A new AWS user credentials creation attempt from an unusual country](/analytics-alerts/alerts-by-name/a-new-aws-user-credentials-creation-attempt-from-an-unusual-country.md)
  * \[Medium] A new AWS user with successfully created credentials from an unusual country
* \[Informational] [Possible DCSync attack](/analytics-alerts/alerts-by-name/possible-dcsync-attack.md)
  * \[Medium] Possible DCSync attack using Impacket-like tool
  * \[Low] Possible DCSync attack using Mimikatz-like tool
  * \[Low] Possible DCSync attack using unknown tool
* \[Medium] [S3 public exposure followed by data access](/analytics-alerts/alerts-by-name/s3-public-exposure-followed-by-data-access.md)
* \[Informational] [Suspicious Entra ID Device Code Authentication Flow](/analytics-alerts/alerts-by-name/suspicious-entra-id-device-code-authentication-flow.md)
  * \[Medium] Suspicious Entra ID Device Code Authentication Flow with suspicious characteristics
  * \[Low] Suspicious Entra ID Device Code Authentication Flow from a risky IP address
  * \[Low] Suspicious Entra ID Device Code Authentication Flow with Entra Identity Protection risk
* \[Low] [A lightweight JavaScript runtime executing a script wrote a Python file to disk](/analytics-alerts/alerts-by-name/a-lightweight-javascript-runtime-executing-a-script-wrote-a-python-file-to-disk.md)
* \[Informational] [Abusable command-line activity by untrusted causality actor](/analytics-alerts/alerts-by-name/abusable-command-line-activity-by-untrusted-causality-actor.md)
  * \[Low] Audit policy clearing via auditpol /clear
  * \[Low] BITS job execution via bitsadmin
  * \[Low] BitLocker encryption status query via Get-BitLockerVolume
  * \[Low] CMSTP proxy execution
  * \[Low] Credential dumping via Invoke-Mimikatz
  * \[Low] Current user identity discovery via whoami
  * \[Low] DLL injection via mavinject
  * \[Low] DNS zone enumeration via dnscmd
  * \[Low] Device Guard status query via Get-CimInstance
  * \[Low] Domain fronting probe via Invoke-WebRequest
  * \[Low] Domain group enumeration via net group
  * \[Low] File permission modification via icacls
  * \[Low] Firewall profile discovery via Get-NetFirewallProfile
  * \[Low] Firewall rule manipulation via netsh advfirewall
  * \[Low] Full network configuration dump via ipconfig /all
  * \[Low] Installed hotfix enumeration via Get-HotFix
  * \[Low] Kerberoasting attack via Invoke-Kerberoast
  * \[Low] LSA registry key reconnaissance via Get-ItemProperty
  * \[Low] LSASS memory dump via rundll32 comsvcs.dll
  * \[Low] Legacy firewall state query via netsh
  * \[Low] Local account discovery via net user
  * \[Low] Local account discovery via net users
  * \[Low] Local group enumeration via net localgroup
  * \[Low] Masquerading binary execution from Temp directory
  * \[Low] Network configuration discovery via ipconfig
  * \[Low] Network share enumeration via net share
  * \[Low] Password policy discovery via net accounts
  * \[Low] PowerShell stealth execution with hidden/bypass flags
  * \[Low] Process hollowing via Start-Hollow
  * \[Low] Reflective PE injection via PowerShell
  * \[Low] Registry credential search via reg query
  * \[Low] Registry modification via regini
  * \[Low] Remote Desktop session enumeration via qwinsta
  * \[Low] Routing table discovery via route print
  * \[Low] SAM registry hive dump via reg save
  * \[Low] SMB session enumeration via net session
  * \[Low] Scheduled task enumeration via Get-ScheduledTask
  * \[Low] Scheduled task management via schtasks
  * \[Low] Secure Boot configuration query via Get-SecureBootPolicy
  * \[Low] Security event log enumeration via Get-EventLog
  * \[Low] Security provider enumeration via Get-SecurityPackages
  * \[Low] Server configuration discovery via net config
  * \[Low] Service stop via net stop
  * \[Low] Signed binary proxy execution via regsvr32
  * \[Low] System event log enumeration via Get-EventLog
  * \[Low] System information discovery via Get-ComputerInfo
  * \[Low] Verbose process listing via tasklist /v
  * \[Low] WMI command-line discovery via wmic
  * \[Low] Windows Defender signature removal via MpCmdRun
  * \[Low] Windows Defender status query via Get-MpComputerStatus
  * \[Low] Windows Update history retrieval via Get-WindowsUpdateLog
  * \[Low] Windows service configuration modification via sc config
* \[Informational] [Docker state manipulation via docker.sock](/analytics-alerts/alerts-by-name/docker-state-manipulation-via-docker-sock.md)
  * \[Low] Docker state manipulation via docker.sock using a first-seen command line
* \[Informational] [Information gathering via docker.sock](/analytics-alerts/alerts-by-name/information-gathering-via-docker-sock.md)
  * \[Low] Information gathering via docker.sock using multiple distinct API calls
  * \[Low] Information gathering via docker.sock via a programmatic socket connection
* \[Informational] [Massive files editing in Box](/analytics-alerts/alerts-by-name/massive-files-editing-in-box.md)
  * \[Low] Massive files edit in Box with suspicious parameters
* \[Informational] [Massive files editing in Dropbox](/analytics-alerts/alerts-by-name/massive-files-editing-in-dropbox.md)
  * \[Low] Massive files editing in Dropbox with suspicious parameters
* \[Informational] [Massive files editing in Google Drive](/analytics-alerts/alerts-by-name/massive-files-editing-in-google-drive.md)
  * \[Low] Massive files editing in Google Drive with suspicious parameters
* \[Informational] [Massive files editing in Microsoft SharePoint or OneDrive](/analytics-alerts/alerts-by-name/massive-files-editing-in-microsoft-sharepoint-or-onedrive.md)
  * \[Low] Massive files editing in Microsoft SharePoint or OneDrive with suspicious parameters
* \[Informational] [Microsoft HTML Application Host spawns from CMD or PowerShell](/analytics-alerts/alerts-by-name/microsoft-html-application-host-spawns-from-cmd-or-powershell.md)
  * \[Low] Microsoft HTML Application Host spawns from CMD or PowerShell by an untrusted causality chain
* \[Informational] [PowerShell running with download in the command line](/analytics-alerts/alerts-by-name/powershell-running-with-download-in-the-command-line.md)
  * \[Low] PowerShell running with download in the command line from an untrusted actor
* \[Informational] [PowerShell script executed from a temporary directory](/analytics-alerts/alerts-by-name/powershell-script-executed-from-a-temporary-directory.md)
  * \[Low] PowerShell script executed from a temporary directory by an untrusted parent process
* \[Informational] [Registry credentials extraction](/analytics-alerts/alerts-by-name/registry-credentials-extraction.md)
  * \[Low] Registry credentials extraction from an untrusted actor
* \[Informational] [Suspicious OAuth application was authorized in Google Workspace](/analytics-alerts/alerts-by-name/suspicious-oauth-application-was-authorized-in-google-workspace.md)
  * \[Low] Possible OAuth application consent phishing with sensitive permissions in Google Workspace
* \[Low] [Uncommon Node.js package initiated communication to an external host](/analytics-alerts/alerts-by-name/uncommon-node-js-package-initiated-communication-to-an-external-host.md)
  * \[Low] Uncommon Node.js package initiated communication to an external host from a package with limited destination diversity
  * \[Low] Uncommon Node.js package initiated communication to an external host over HTTP on a non-standard port
  * \[Low] Uncommon Node.js package initiated communication to an external host reaching a rare external host
* \[Informational] [Uncommon network connection under an untrusted and newly created causality actor](/analytics-alerts/alerts-by-name/uncommon-network-connection-under-an-untrusted-and-newly-created-causality-actor.md)
  * \[Low] Uncommon network connection from a LOLBIN under a newly created and untrusted causality actor
  * \[Low] Uncommon network connection from a browser running under a newly created and untrusted causality actor
  * \[Low] Uncommon network connection from an unsigned process under a newly created and untrusted causality actor
* \[Informational] [Uncommon network connection under an untrusted causality actor](/analytics-alerts/alerts-by-name/uncommon-network-connection-under-an-untrusted-causality-actor.md)
  * \[Low] Uncommon network connection from a LOLBIN under an untrusted causality actor
  * \[Low] Uncommon network connection from a browser running under an untrusted causality actor
  * \[Low] Uncommon network connection from an unsigned process under an untrusted causality actor
* \[Informational] [Unsigned process running from a temporary directory](/analytics-alerts/alerts-by-name/unsigned-process-running-from-a-temporary-directory.md)
  * \[Low] Unsigned process running from a temporary directory spawned by an untrusted parent process
* \[Informational] [Email with Google Apps Script web app URL detected](/analytics-alerts/alerts-by-name/email-with-google-apps-script-web-app-url-detected.md)
* \[Informational] [Internal address failed authentication](/analytics-alerts/alerts-by-name/internal-address-failed-authentication.md)
* \[Informational] [Sender name used by multiple addresses across multiple domains](/analytics-alerts/alerts-by-name/sender-name-used-by-multiple-addresses-across-multiple-domains.md)
  * \[Informational] High-volume sender name reuse (multiple domains)
  * \[Informational] Rapid high-volume sender name reuse (multiple domains)
  * \[Informational] Rapid sender name reuse (multiple domains)

### Removed

* \[Informational] Microsoft HTML Application Host spawns from CMD or PowerShell
* \[Informational] PowerShell running with download in the command line
* \[Informational] PowerShell script executed from a temporary directory
* \[Informational] Registry credentials extraction
* \[Informational] Unsigned process running from a temporary directory

### Modified Logic

* \[Low] [AWS S3 bucket or object was exposed to public access](/analytics-alerts/alerts-by-name/aws-s3-bucket-or-object-was-exposed-to-public-access.md)
  * \[High] AWS S3 bucket was exposed to public access containing sensitive information - Modified Metadata
  * \[Informational] AWS S3 bucket was exposed to public access by admin cloud identity - Modified Metadata
* \[High] [Copy a process memory file](/analytics-alerts/alerts-by-name/copy-a-process-memory-file.md)
* \[High] [Hydra Password Brute-Force Tool Execution](/analytics-alerts/alerts-by-name/hydra-password-brute-force-tool-execution.md)
* \[High] [Memory dumping with comsvcs.dll](/analytics-alerts/alerts-by-name/memory-dumping-with-comsvcs-dll.md)
* \[High] [Mimikatz command-line arguments](/analytics-alerts/alerts-by-name/mimikatz-command-line-arguments.md)
* \[High] [Suspicious usage of File Server Remote VSS Protocol (FSRVP)](/analytics-alerts/alerts-by-name/suspicious-usage-of-file-server-remote-vss-protocol-fsrvp.md)
* \[High] [Uncommon AppleScript designed to access sensitive application data was executed via the command line](/analytics-alerts/alerts-by-name/uncommon-applescript-designed-to-access-sensitive-application-data-was-executed-via-the-command-line.md)
* \[Informational] [Uncommon macOS process communication to a rare external host](/analytics-alerts/alerts-by-name/uncommon-macos-process-communication-to-a-rare-external-host.md)
  * \[High] Uncommon macOS process communication to a rare external host initiated by an AppleScript interpreter - Added
  * \[High] Uncommon macOS process communication to a rare external host while retrieving a hash-named staged payload - Added
* \[High] [Unicode RTL Override Character](/analytics-alerts/alerts-by-name/unicode-rtl-override-character.md)
* \[Informational] [Unsigned DLL Side-Loading](/analytics-alerts/alerts-by-name/unsigned-dll-side-loading.md)
  * \[High] DLL Side-Loading of module bearing an invalid Microsoft signature - Modified Metadata
  * \[Medium] Unsigned DLL Side-Loading by a locally rare but globally common non-Microsoft process - Added
  * \[Medium] Unsigned DLL Side-Loading by a rarely-seen security-vendor-signed process - Added
  * \[Medium] Unsigned DLL Side-Loading of a Windows system DLL name - Added
  * \[Medium] Unsigned DLL Side-Loading of a commonly-abused third-party DLL name - Added
  * \[Medium] Unsigned DLL Side-Loading to a signed Microsoft process by a rare causality actor - Modified Metadata
  * \[Medium] Unsigned DLL Side-Loading triggered by a rarely-seen remote-management tool - Added
  * \[Low] Unsigned DLL Side-Loading by a locally rare but globally common process - Added
  * \[Low] Unsigned DLL Side-Loading by a rarely-seen process masquerading as a known module load - Added
  * \[Low] Unsigned DLL Side-Loading from a user-writable folder by a globally rare process path - Added
  * \[Low] Unsigned DLL Side-Loading to a signed Microsoft process - Modified Metadata
  * \[Low] Unsigned DLL Side-Loading triggered by a remote causality actor - Added
  * \[Low] Unsigned high entropy DLL Side-Loading by untrusted causality actor - Modified Metadata
* \[Medium] [A TCP stream was created directly in a shell](/analytics-alerts/alerts-by-name/a-tcp-stream-was-created-directly-in-a-shell.md)
* \[Low] [A commonly abused process connected to a rare cloud resource](/analytics-alerts/alerts-by-name/a-commonly-abused-process-connected-to-a-rare-cloud-resource.md)
  * \[Medium] A commonly abused renamed process connected to a rare cloud resource - Modified Logic
* \[Informational] [A possible risky login to Azure](/analytics-alerts/alerts-by-name/a-possible-risky-login-to-azure.md)
  * \[Medium] Azure Risky Login with Suspicious Characteristics via a suspicious IP - Added
* \[Medium] [A process was executed with a command line obfuscated by Unicode character substitution](/analytics-alerts/alerts-by-name/a-process-was-executed-with-a-command-line-obfuscated-by-unicode-character-substitution.md)
* \[Medium] [Autorun.inf created in root C drive](/analytics-alerts/alerts-by-name/autorun-inf-created-in-root-c-drive.md)
* \[Medium] [Encoded information using Windows certificate management tool](/analytics-alerts/alerts-by-name/encoded-information-using-windows-certificate-management-tool.md)
* \[Informational] [Exchange inbox forwarding rule configured](/analytics-alerts/alerts-by-name/exchange-inbox-forwarding-rule-configured.md)
  * \[Medium] Suspicious Exchange inbox forwarding rule configured - Modified Logic
* \[Medium] [Executable created to disk by lsass.exe](/analytics-alerts/alerts-by-name/executable-created-to-disk-by-lsass-exe.md)
* \[Informational] [First SSO access from ASN in organization](/analytics-alerts/alerts-by-name/first-sso-access-from-asn-in-organization.md)
  * \[Medium] First successful SSO access from ASN in the organization via a suspicious IP - Added
  * \[Informational] Google Workspace - First SSO access from ASN in organization - Removed
* \[Informational] [First connection from a country in organization](/analytics-alerts/alerts-by-name/first-connection-from-a-country-in-organization.md)
  * \[Medium] First successful SSO connection from a country in organization via a suspicious IP - Added
* \[Medium] [Fodhelper.exe UAC bypass](/analytics-alerts/alerts-by-name/fodhelper-exe-uac-bypass.md)
* \[Medium] [Indirect command execution using the Program Compatibility Assistant](/analytics-alerts/alerts-by-name/indirect-command-execution-using-the-program-compatibility-assistant.md)
* \[Low] [LOLBIN process executed with a high integrity level](/analytics-alerts/alerts-by-name/lolbin-process-executed-with-a-high-integrity-level.md)
  * \[Medium] LOLBIN process executed with a high integrity level by a web server process or CGO - Modified Logic
* \[Medium] [LSASS dump file written to disk](/analytics-alerts/alerts-by-name/lsass-dump-file-written-to-disk.md)
* \[Low] [Okta FastPass reported phishing attack suspected](/analytics-alerts/alerts-by-name/okta-fastpass-reported-phishing-attack-suspected.md)
  * \[Medium] Okta FastPass reported phishing attack suspected from a suspicious IP - Modified Logic
* \[Medium] [Phantom DLL Loading](/analytics-alerts/alerts-by-name/phantom-dll-loading.md)
* \[Medium] [Possible Persistence via group policy Registry keys](/analytics-alerts/alerts-by-name/possible-persistence-via-group-policy-registry-keys.md)
* \[Medium] [Possible RDP session hijacking using tscon.exe](/analytics-alerts/alerts-by-name/possible-rdp-session-hijacking-using-tscon-exe.md)
* \[Medium] [Possible code downloading from a remote host by Regsvr32](/analytics-alerts/alerts-by-name/possible-code-downloading-from-a-remote-host-by-regsvr32.md)
* \[Medium] [Possible collection of screen captures with Windows Problem Steps Recorder](/analytics-alerts/alerts-by-name/possible-collection-of-screen-captures-with-windows-problem-steps-recorder.md)
* \[Low] [Possible external RDP Brute-Force](/analytics-alerts/alerts-by-name/possible-external-rdp-brute-force.md)
  * \[Medium] Possible external RDP Brute-Force on a Honey User Account - Modified Metadata
* \[Medium] [Possible malicious .NET compilation started by a commonly abused process](/analytics-alerts/alerts-by-name/possible-malicious-net-compilation-started-by-a-commonly-abused-process.md)
* \[Medium] [Potential Phishing has been detected](/analytics-alerts/alerts-by-name/potential-phishing-has-been-detected.md)
* \[Medium] [PowerShell suspicious flags](/analytics-alerts/alerts-by-name/powershell-suspicious-flags.md)
* \[Medium] [Procdump executed from an atypical directory](/analytics-alerts/alerts-by-name/procdump-executed-from-an-atypical-directory.md)
* \[Low] [Rare binary connected to a rare cloud resource](/analytics-alerts/alerts-by-name/rare-binary-connected-to-a-rare-cloud-resource.md)
  * \[Medium] Recently downloaded rare binary connected to a rare cloud resource - Modified Logic
* \[Informational] [Rare connection to external IP address or host by an application using RMI-IIOP or LDAP protocol](/analytics-alerts/alerts-by-name/rare-connection-to-external-ip-address-or-host-by-an-application-using-rmi-iiop-or-ldap-protocol.md)
  * \[Medium] Rare connection to external IP address or host by a java application using LDAP protocol - Modified Logic
  * \[Medium] Rare connection to external IP address or host by a java application using LDAP protocol - Modified Logic
* \[Medium] [Remote WMI process execution](/analytics-alerts/alerts-by-name/remote-wmi-process-execution.md)
* \[Low] [Remote usage of EC2 token](/analytics-alerts/alerts-by-name/remote-usage-of-ec2-token.md)
  * \[Medium] Suspicious usage of EC2 token - Modified Logic
* \[Medium] [Rundll32.exe running with no command-line arguments](/analytics-alerts/alerts-by-name/rundll32-exe-running-with-no-command-line-arguments.md)
* \[Medium] [Rundll32.exe spawns conhost.exe](/analytics-alerts/alerts-by-name/rundll32-exe-spawns-conhost-exe.md)
* \[Low] [SSO authentication by a machine account](/analytics-alerts/alerts-by-name/sso-authentication-by-a-machine-account.md)
  * \[Medium] SSO authentication by a machine account from a suspicious IP - Modified Logic
* \[Medium] [Script file added to startup-related Registry keys](/analytics-alerts/alerts-by-name/script-file-added-to-startup-related-registry-keys.md)
* \[Informational] [Successful universal authentication with suspicious features](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/successful-universal-authentication-with-suspicious-features)
  * \[Medium] Successful universal authentication sign-in from a TOR exit node - Modified Logic
  * \[Low] Successful universal authentication from a suspicious tunnel operator - Modified Logic
* \[Medium] [Suspicious .NET process loads an MSBuild DLL](/analytics-alerts/alerts-by-name/suspicious-net-process-loads-an-msbuild-dll.md)
* \[Medium] [Suspicious PowerSploit's recon module (PowerView) net function was executed](/analytics-alerts/alerts-by-name/suspicious-powersploit-s-recon-module-powerview-net-function-was-executed.md)
* \[Medium] [Suspicious PowerSploit's recon module (PowerView) used to search for exposed hosts](/analytics-alerts/alerts-by-name/suspicious-powersploit-s-recon-module-powerview-used-to-search-for-exposed-hosts.md)
* \[Medium] [Suspicious Process Spawned by wininit.exe](/analytics-alerts/alerts-by-name/suspicious-process-spawned-by-wininit-exe.md)
* \[Informational] [Suspicious access to cloud credential files](/analytics-alerts/alerts-by-name/suspicious-access-to-cloud-credential-files.md)
  * \[Medium] Suspicious access to Amazon SSM Hybrid Activation credential files - Added
* \[Medium] [Suspicious certutil command line](/analytics-alerts/alerts-by-name/suspicious-certutil-command-line.md)
* \[Medium] [Uncommon AppleScript designed to access credential files was executed via the command line](/analytics-alerts/alerts-by-name/uncommon-applescript-designed-to-access-credential-files-was-executed-via-the-command-line.md)
* \[Medium] [Uncommon DLL-sideloading from a logical CD-ROM (ISO) device](/analytics-alerts/alerts-by-name/uncommon-dll-sideloading-from-a-logical-cd-rom-iso-device.md)
* \[Medium] [Uncommon SetWindowsHookEx API invocation of a possible keylogger](/analytics-alerts/alerts-by-name/uncommon-setwindowshookex-api-invocation-of-a-possible-keylogger.md)
* \[Informational] [Uncommon access to /etc/passwd](/analytics-alerts/alerts-by-name/uncommon-access-to-etc-passwd.md)
  * \[Medium] Uncommon access to /etc/passwd by a security testing tool - Modified Logic
  * \[Low] Uncommon link creation to /etc/passwd - Modified Logic
* \[Low] [Uncommon attempt to clear shell history](/analytics-alerts/alerts-by-name/uncommon-attempt-to-clear-shell-history.md)
  * \[Medium] Globally uncommon attempt to clear shell history - Modified Logic
* \[Low] [Uncommon driver loaded](/analytics-alerts/alerts-by-name/uncommon-driver-loaded.md)
  * \[Medium] Globally rare and unsigned driver loaded - Modified Logic
* \[Informational] [Uncommon net localgroup command execution](/analytics-alerts/alerts-by-name/uncommon-net-localgroup-command-execution.md)
  * \[Medium] Uncommon net localgroup administrators command execution by a web server process or CGO - Modified Logic
* \[Informational] [Uncommon user management via net command](/analytics-alerts/alerts-by-name/uncommon-user-management-via-net-command.md)
  * \[Medium] Uncommon user management via net command by a web server process or CGO - Modified Logic
* \[Medium] [Unsigned process injecting into a Windows system binary with no command line](/analytics-alerts/alerts-by-name/unsigned-process-injecting-into-a-windows-system-binary-with-no-command-line.md)
* \[Informational] [Unusual Kubernetes service account file read](/analytics-alerts/alerts-by-name/unusual-kubernetes-service-account-file-read.md)
  * \[Medium] Suspicious Kubernetes service account file read from the projected volume path - Modified Logic
  * \[Low] Suspicious Kubernetes service account file read by an unusual process - Modified Logic
  * \[Low] Suspicious Kubernetes service account token read - Modified Logic
  * \[Low] Suspicious Kubernetes service account token read by an unusual process - Modified Logic
  * \[Informational] Unusual Kubernetes service account file read within a new pod - Modified Logic
* \[Medium] [Unusual process access to ld.so.preload file](/analytics-alerts/alerts-by-name/unusual-process-access-to-ld-so-preload-file.md)
* \[Medium] [Unusual process executed by AWS Systems Manager](/analytics-alerts/alerts-by-name/unusual-process-executed-by-aws-systems-manager.md)
* \[Low] [A commonly abused process connected to a rare external host](/analytics-alerts/alerts-by-name/a-commonly-abused-process-connected-to-a-rare-external-host.md)
* \[Informational] [A disabled user attempted to authenticate via SSO](/analytics-alerts/alerts-by-name/a-disabled-user-attempted-to-authenticate-via-sso.md)
  * \[Low] A disabled user attempted to authenticate via SSO from a suspicious IP - Modified Logic
* \[Informational] [A process connected to a rare external host](/analytics-alerts/alerts-by-name/a-process-connected-to-a-rare-external-host.md)
  * \[Low] UNIX LOLBIN process connected to a rare external host - Modified Logic
* \[Low] [A process queried the ADFS database decryption key via LDAP](/analytics-alerts/alerts-by-name/a-process-queried-the-adfs-database-decryption-key-via-ldap.md)
* \[Informational] [AI-determined combination of risky alerts under the same causality](/analytics-alerts/alerts-by-name/ai-determined-combination-of-risky-alerts-under-the-same-causality.md)
  * \[Low] AI-determined combination of risky alerts under the same causality: user and group reconnaissance and management - Added
* \[Low] [AWS data asset shared public](/analytics-alerts/alerts-by-name/aws-data-asset-shared-public.md)
* \[Informational] [AWS user creation](/analytics-alerts/alerts-by-name/aws-user-creation.md)
  * \[Low] AWS user creation from an unfamiliar IP address - Added
* \[Informational -> Low] [Access to sensitive host files from within a Kubernetes pod](/analytics-alerts/alerts-by-name/access-to-sensitive-host-files-from-within-a-kubernetes-pod.md)
  * \[Medium -> Low] Access to sensitive host files from within a Kubernetes pod via an interactive shell - Modified Logic
  * \[Low] Unusual access to sensitive host files from within a Kubernetes pod - Modified Logic
* \[Low] [An identity successfully extracted multiple secrets within the organization](/analytics-alerts/alerts-by-name/an-identity-successfully-extracted-multiple-secrets-within-the-organization.md)
* \[Informational] [An inactive user attempted to authenticate](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-inactive-user-attempted-to-authenticate)
  * \[Low] An inactive user attempted to authenticate from a risky IP address - Modified Logic
  * \[Low] Successful authentication by an inactive user from a risky IP address - Modified Logic
* \[Informational] [An uncommon file added to startup-related Registry keys](/analytics-alerts/alerts-by-name/an-uncommon-file-added-to-startup-related-registry-keys.md)
  * \[Low] An uncommon file added to startup-related Registry keys by a commonly known and signed application - Removed
* \[Low] [An uncommon service was started](/analytics-alerts/alerts-by-name/an-uncommon-service-was-started.md)
* \[Low] [An unpopular process accessed the microphone on the host](/analytics-alerts/alerts-by-name/an-unpopular-process-accessed-the-microphone-on-the-host.md)
* \[Low] [Attempt to execute a command on a remote host using PsExec.exe](/analytics-alerts/alerts-by-name/attempt-to-execute-a-command-on-a-remote-host-using-psexec-exe.md)
* \[Low] [Cached credentials discovery with cmdkey](/analytics-alerts/alerts-by-name/cached-credentials-discovery-with-cmdkey.md)
* \[Low] [Change of sudo caching configuration](/analytics-alerts/alerts-by-name/change-of-sudo-caching-configuration.md)
* \[Informational] [Common third-party software name masquerading](/analytics-alerts/alerts-by-name/common-third-party-software-name-masquerading.md)
  * \[Low] Common third-party software name masquerading with uncommon characteristics by actor with uncommon characteristics - Modified Logic
* \[Low] [Compressing data using python](/analytics-alerts/alerts-by-name/compressing-data-using-python.md)
* \[Low] [Conhost.exe spawned a suspicious cmd process](/analytics-alerts/alerts-by-name/conhost-exe-spawned-a-suspicious-cmd-process.md)
* \[Low] [Copy a user's GnuPG directory with rsync](/analytics-alerts/alerts-by-name/copy-a-user-s-gnupg-directory-with-rsync.md)
* \[Low] [Disable Microsoft Defender Antivirus via registry](/analytics-alerts/alerts-by-name/disable-microsoft-defender-antivirus-via-registry.md)
* \[Low] [Download a script using the python requests module](/analytics-alerts/alerts-by-name/download-a-script-using-the-python-requests-module.md)
* \[Low] [Elevation to SYSTEM via services](/analytics-alerts/alerts-by-name/elevation-to-system-via-services.md)
* \[Informational] [Email contains URL delivering high-risk file type](/analytics-alerts/alerts-by-name/email-contains-url-delivering-high-risk-file-type.md)
  * \[Low] External email with URL delivers blocked file types - Modified Logic
* \[Low] [Email was received from an unknown sender using a disposable domain](/analytics-alerts/alerts-by-name/email-was-received-from-an-unknown-sender-using-a-disposable-domain.md)
* \[Low] [Email with file-sharing link containing auto-download parameter](/analytics-alerts/alerts-by-name/email-with-file-sharing-link-containing-auto-download-parameter.md)
  * \[Low] External email with file-sharing link containing auto-download parameter - Modified Logic
* \[Low] [Exchange DKIM signing configuration disabled](/analytics-alerts/alerts-by-name/exchange-dkim-signing-configuration-disabled.md)
* \[Low] [Exchange Safe Attachment policy disabled or removed](/analytics-alerts/alerts-by-name/exchange-safe-attachment-policy-disabled-or-removed.md)
* \[Low] [Exchange Safe Link policy disabled or removed](/analytics-alerts/alerts-by-name/exchange-safe-link-policy-disabled-or-removed.md)
* \[Low] [Exchange anti-phish policy disabled or removed](/analytics-alerts/alerts-by-name/exchange-anti-phish-policy-disabled-or-removed.md)
* \[Low] [Exchange audit log disabled](/analytics-alerts/alerts-by-name/exchange-audit-log-disabled.md)
* \[Low] [Exchange transport forwarding rule configured](/analytics-alerts/alerts-by-name/exchange-transport-forwarding-rule-configured.md)
* \[Low] [Exchange user mailbox forwarding](/analytics-alerts/alerts-by-name/exchange-user-mailbox-forwarding.md)
* \[Low] [Executable or Script file written by a web server process](/analytics-alerts/alerts-by-name/executable-or-script-file-written-by-a-web-server-process.md)
* \[Low] [Execution of an uncommon process at an early startup stage by Windows system binary](/analytics-alerts/alerts-by-name/execution-of-an-uncommon-process-at-an-early-startup-stage-by-windows-system-binary.md)
* \[Low] [Execution of an uncommon process with a local/domain user SID at early startup by a system binary](/analytics-alerts/alerts-by-name/execution-of-an-uncommon-process-with-a-local-domain-user-sid-at-early-startup-by-a-system-binary.md)
* \[Low] [Execution of dllhost.exe with an empty command line](/analytics-alerts/alerts-by-name/execution-of-dllhost-exe-with-an-empty-command-line.md)
  * \[Low] Globally uncommon execution of dllhost.exe with an empty command line - Modified Logic
* \[Informational] [External user added a link to a Microsoft Teams chat](/analytics-alerts/alerts-by-name/external-user-added-a-link-to-a-microsoft-teams-chat.md)
  * \[Low] An external user sent a link via Microsoft Teams with suspicious parameters - Modified Logic
* \[Informational] [External user started a Microsoft Teams conversation](/analytics-alerts/alerts-by-name/external-user-started-a-microsoft-teams-conversation.md)
  * \[Low] An external user started a conversation in Microsoft Teams with a suspicious user or chat name - Modified Metadata
  * \[Low] An external user started multiple conversations in Microsoft Teams with suspicious chat names - Modified Metadata
* \[Low] [Extracting credentials from Unix files](/analytics-alerts/alerts-by-name/extracting-credentials-from-unix-files.md)
* \[Low] [Failed Connections](/analytics-alerts/alerts-by-name/failed-connections.md)
* \[Informational] [Globally uncommon high entropy process was executed](/analytics-alerts/alerts-by-name/globally-uncommon-high-entropy-process-was-executed.md)
  * \[Low] Globally uncommon high entropy process was executed by a web server process or CGO - Modified Logic
* \[Informational] [IP Rotation Pattern in SSO Spray](/analytics-alerts/alerts-by-name/ip-rotation-pattern-in-sso-spray.md)
  * \[Low] Suspicious SSO Login Attempts from Multiple IPs - Modified Logic
* \[Low] [Image file execution options (IFEO) registry key set](/analytics-alerts/alerts-by-name/image-file-execution-options-ifeo-registry-key-set.md)
* \[Low] [Installation of a new System-V service](/analytics-alerts/alerts-by-name/installation-of-a-new-system-v-service.md)
* \[Low] [Interactive at.exe privilege escalation method](/analytics-alerts/alerts-by-name/interactive-at-exe-privilege-escalation-method.md)
* \[Low] [Keylogging using system commands](/analytics-alerts/alerts-by-name/keylogging-using-system-commands.md)
* \[Low] [Known service display name with uncommon image-path](/analytics-alerts/alerts-by-name/known-service-display-name-with-uncommon-image-path.md)
* \[Low] [Known service name with an uncommon image-path](/analytics-alerts/alerts-by-name/known-service-name-with-an-uncommon-image-path.md)
* \[Low] [Kubernetes pod creation from unknown container image registry](/analytics-alerts/alerts-by-name/kubernetes-pod-creation-from-unknown-container-image-registry.md)
* \[Low] [Linux system firewall was modified](/analytics-alerts/alerts-by-name/linux-system-firewall-was-modified.md)
* \[Low] [Masquerading as the Linux crond process](/analytics-alerts/alerts-by-name/masquerading-as-the-linux-crond-process.md)
* \[Low] [Microsoft Office Process Spawning a Suspicious One-Liner](/analytics-alerts/alerts-by-name/microsoft-office-process-spawning-a-suspicious-one-liner.md)
* \[Low] [Microsoft Office adds a value to autostart Registry key](/analytics-alerts/alerts-by-name/microsoft-office-adds-a-value-to-autostart-registry-key.md)
* \[Low] [Microsoft Office injects code into a process](/analytics-alerts/alerts-by-name/microsoft-office-injects-code-into-a-process.md)
* \[Low] [Microsoft Office process spawns a commonly abused process](/analytics-alerts/alerts-by-name/microsoft-office-process-spawns-a-commonly-abused-process.md)
* \[Low] [Microsoft Office process spawns conhost.exe](/analytics-alerts/alerts-by-name/microsoft-office-process-spawns-conhost-exe.md)
* \[Low] [Modification of NTLM restrictions in the Registry](/analytics-alerts/alerts-by-name/modification-of-ntlm-restrictions-in-the-registry.md)
* \[Low] [Mshta.exe spawns from a browser process](/analytics-alerts/alerts-by-name/mshta-exe-spawns-from-a-browser-process.md)
* \[Low] [Multiple Rare LOLBIN Process Executions by User](/analytics-alerts/alerts-by-name/multiple-rare-lolbin-process-executions-by-user.md)
* \[Low] [Multiple discovery commands](/analytics-alerts/alerts-by-name/multiple-discovery-commands.md)
* \[Low] [Multiple discovery commands on a Windows host by the same process](/analytics-alerts/alerts-by-name/multiple-discovery-commands-on-a-windows-host-by-the-same-process.md)
* \[Low] [Office process accessed an unusual .LNK file](/analytics-alerts/alerts-by-name/office-process-accessed-an-unusual-lnk-file.md)
* \[Low] [Office process spawned with suspicious command-line arguments](/analytics-alerts/alerts-by-name/office-process-spawned-with-suspicious-command-line-arguments.md)
* \[Low] [Outlook files accessed by an unsigned process](/analytics-alerts/alerts-by-name/outlook-files-accessed-by-an-unsigned-process.md)
* \[Low] [Possible DLL Search Order Hijacking](/analytics-alerts/alerts-by-name/possible-dll-search-order-hijacking.md)
* \[Low] [Possible network sniffing attempt via tcpdump or tshark](/analytics-alerts/alerts-by-name/possible-network-sniffing-attempt-via-tcpdump-or-tshark.md)
* \[Low] [Possible phishing attack via Microsoft Teams](/analytics-alerts/alerts-by-name/possible-phishing-attack-via-microsoft-teams.md)
* \[Low] [Possible webshell file written by a web server process](/analytics-alerts/alerts-by-name/possible-webshell-file-written-by-a-web-server-process.md)
* \[Low] [PowerShell runs suspicious base64-encoded commands](/analytics-alerts/alerts-by-name/powershell-runs-suspicious-base64-encoded-commands.md)
* \[Low] [RDP connections enabled remotely via Registry](/analytics-alerts/alerts-by-name/rdp-connections-enabled-remotely-via-registry.md)
* \[Low] [Rare binary connected to a rare external host](/analytics-alerts/alerts-by-name/rare-binary-connected-to-a-rare-external-host.md)
* \[Low] [Rare process created an SSH session to an uncommon cloud resource](/analytics-alerts/alerts-by-name/rare-process-created-an-ssh-session-to-an-uncommon-cloud-resource.md)
* \[Low] [Rare process created an SSH session to an uncommon external host](/analytics-alerts/alerts-by-name/rare-process-created-an-ssh-session-to-an-uncommon-external-host.md)
* \[Low] [Rare process executed by an AppleScript](/analytics-alerts/alerts-by-name/rare-process-executed-by-an-applescript.md)
* \[Informational] [Rare scheduled task created](/analytics-alerts/alerts-by-name/rare-scheduled-task-created.md)
  * \[Low] Uncommon local scheduled task created - Modified Logic
* \[Low] [Rare service DLL was added to the registry](/analytics-alerts/alerts-by-name/rare-service-dll-was-added-to-the-registry.md)
* \[Low] [Rare unsigned process execution by scheduled task](/analytics-alerts/alerts-by-name/rare-unsigned-process-execution-by-scheduled-task.md)
* \[Low] [Reading bash command history file](/analytics-alerts/alerts-by-name/reading-bash-command-history-file.md)
* \[Low] [Recurring rare domain access from an unsigned process](/analytics-alerts/alerts-by-name/recurring-rare-domain-access-from-an-unsigned-process.md)
* \[Low] [Remote DCOM command execution](/analytics-alerts/alerts-by-name/remote-dcom-command-execution.md)
* \[Low] [Remote command execution via wmic.exe](/analytics-alerts/alerts-by-name/remote-command-execution-via-wmic-exe.md)
* \[Low] [Remote service start from an uncommon source](/analytics-alerts/alerts-by-name/remote-service-start-from-an-uncommon-source.md)
* \[Low] [Rundll32.exe executes a rare unsigned module](/analytics-alerts/alerts-by-name/rundll32-exe-executes-a-rare-unsigned-module.md)
* \[Low] [SSO authentication attempt by a honey user](/analytics-alerts/alerts-by-name/sso-authentication-attempt-by-a-honey-user.md)
* \[Low] [SSO authentication by a service account](/analytics-alerts/alerts-by-name/sso-authentication-by-a-service-account.md)
* \[Low] [SUID/GUID permission discovery](/analytics-alerts/alerts-by-name/suid-guid-permission-discovery.md)
* \[Low] [Scheduled Task hidden by registry modification](/analytics-alerts/alerts-by-name/scheduled-task-hidden-by-registry-modification.md)
* \[Low] [Screensaver process executed from Users or temporary folder](/analytics-alerts/alerts-by-name/screensaver-process-executed-from-users-or-temporary-folder.md)
* \[Low] [Scripting engine connected to a rare external host](/analytics-alerts/alerts-by-name/scripting-engine-connected-to-a-rare-external-host.md)
  * \[Low] Scripting engine with a modified image name connected to a rare external host - Modified Logic
* \[Informational] [Sensitive browser credential files accessed by a rare non browser process](/analytics-alerts/alerts-by-name/sensitive-browser-credential-files-accessed-by-a-rare-non-browser-process.md)
  * \[Low] Sensitive browser credential files accessed by a rare non browser process from a commonly abused directory - Modified Logic
* \[Low] [Setting Windows Auto Logon by uncommon process](/analytics-alerts/alerts-by-name/setting-windows-auto-logon-by-uncommon-process.md)
* \[Low] [Setuid and Setgid file bit manipulation](/analytics-alerts/alerts-by-name/setuid-and-setgid-file-bit-manipulation.md)
* \[Low] [Stored credentials exported using credwiz.exe](/analytics-alerts/alerts-by-name/stored-credentials-exported-using-credwiz-exe.md)
* \[Low] [Suspicious Certutil AD CS contact](/analytics-alerts/alerts-by-name/suspicious-certutil-ad-cs-contact.md)
* \[Low] [Suspicious DotNet log file created](/analytics-alerts/alerts-by-name/suspicious-dotnet-log-file-created.md)
* \[Low] [Suspicious Print System Remote Protocol usage by a process](/analytics-alerts/alerts-by-name/suspicious-print-system-remote-protocol-usage-by-a-process.md)
* \[Informational] [Suspicious SSO access from ASN](/analytics-alerts/alerts-by-name/suspicious-sso-access-from-asn.md)
  * \[Low] Suspicious SSO access from ASN via a suspicious IP - Modified Logic
* \[Low] [Suspicious container orchestration job](/analytics-alerts/alerts-by-name/suspicious-container-orchestration-job.md)
* \[Low] [Suspicious disablement of the Windows Firewall](/analytics-alerts/alerts-by-name/suspicious-disablement-of-the-windows-firewall.md)
* \[Low] [Suspicious process modified RC script file](/analytics-alerts/alerts-by-name/suspicious-process-modified-rc-script-file.md)
* \[Low] [Suspicious sshpass command execution](/analytics-alerts/alerts-by-name/suspicious-sshpass-command-execution.md)
* \[Low] [Suspicious systemd timer activity](/analytics-alerts/alerts-by-name/suspicious-systemd-timer-activity.md)
* \[Low] [Svchost.exe loads a rare unsigned module](/analytics-alerts/alerts-by-name/svchost-exe-loads-a-rare-unsigned-module.md)
* \[Low] [The Linux system firewall was disabled](/analytics-alerts/alerts-by-name/the-linux-system-firewall-was-disabled.md)
* \[Low] [Training simulation email detected](/analytics-alerts/alerts-by-name/training-simulation-email-detected.md)
* \[Low] [Uncommon AppleScript containing a potential obfuscation technique was executed](/analytics-alerts/alerts-by-name/uncommon-applescript-containing-a-potential-obfuscation-technique-was-executed.md)
* \[Low] [Uncommon AppleScript containing a potential persistence command was executed via the command line](/analytics-alerts/alerts-by-name/uncommon-applescript-containing-a-potential-persistence-command-was-executed-via-the-command-line.md)
* \[Low] [Uncommon AppleScript designed to capture screen or clipboard data was executed via the command line](/analytics-alerts/alerts-by-name/uncommon-applescript-designed-to-capture-screen-or-clipboard-data-was-executed-via-the-command-line.md)
* \[Low] [Uncommon AppleScript potentially utilizes credential-grabbing techniques to steal user passwords](/analytics-alerts/alerts-by-name/uncommon-applescript-potentially-utilizes-credential-grabbing-techniques-to-steal-user-passwords.md)
* \[Low] [Uncommon AppleScript was executed via the command line to contact an external server](/analytics-alerts/alerts-by-name/uncommon-applescript-was-executed-via-the-command-line-to-contact-an-external-server.md)
* \[Low] [Uncommon AppleScript with a potential defense-evasion command was executed via the command line](/analytics-alerts/alerts-by-name/uncommon-applescript-with-a-potential-defense-evasion-command-was-executed-via-the-command-line.md)
* \[Low] [Uncommon AppleScript with a potential discovery command was executed via the command line](/analytics-alerts/alerts-by-name/uncommon-applescript-with-a-potential-discovery-command-was-executed-via-the-command-line.md)
* \[Informational] [Uncommon Launch Agent persistency was registered or modified](/analytics-alerts/alerts-by-name/uncommon-launch-agent-persistency-was-registered-or-modified.md)
  * \[Low] Uncommon Launch Agent persistency was registered or modified with an unusual persistency executable path - Modified Logic
* \[Informational] [Uncommon Launch Daemon persistency was registered or modified](/analytics-alerts/alerts-by-name/uncommon-launch-daemon-persistency-was-registered-or-modified.md)
  * \[Low] Uncommon Launch Daemon persistency was registered or modified with an unusual persistency executable path - Modified Logic
* \[Informational] [Uncommon Linux process communication to a rare external host](/analytics-alerts/alerts-by-name/uncommon-linux-process-communication-to-a-rare-external-host.md)
  * \[Low] Uncommon Linux process communication to a rare external host involving a low-prevalence process connecting to a rare Top-Level Domain - Modified Logic
  * \[Low] Uncommon Linux process communication to a rare external host using a data transfer tool - Modified Logic
  * \[Low] Uncommon Linux process communication to a rare external host with an external IP in the command line - Modified Logic
* \[Low] [Uncommon PowerShell commands used to create or alter scheduled task parameters](/analytics-alerts/alerts-by-name/uncommon-powershell-commands-used-to-create-or-alter-scheduled-task-parameters.md)
* \[Informational] [Uncommon SQL like command line](/analytics-alerts/alerts-by-name/uncommon-sql-like-command-line.md)
  * \[Low] Uncommon SQL like command line executed by an uncommon CGO - Modified Logic
* \[Low] [Uncommon SSH session was established](/analytics-alerts/alerts-by-name/uncommon-ssh-session-was-established.md)
* \[Low] [Uncommon access to Microsoft Teams credential files](/analytics-alerts/alerts-by-name/uncommon-access-to-microsoft-teams-credential-files.md)
* \[Low] [Uncommon creation or access operation of sensitive shadow copy](/analytics-alerts/alerts-by-name/uncommon-creation-or-access-operation-of-sensitive-shadow-copy.md)
* \[Low] [Uncommon execution of ODBCConf](/analytics-alerts/alerts-by-name/uncommon-execution-of-odbcconf.md)
* \[Low] [Uncommon msiexec execution of an arbitrary file from a remote location](/analytics-alerts/alerts-by-name/uncommon-msiexec-execution-of-an-arbitrary-file-from-a-remote-location.md)
* \[Informational] [Uncommon recurring rare external host access](/analytics-alerts/alerts-by-name/uncommon-recurring-rare-external-host-access.md)
  * \[Low] Uncommon recurring rare external host access using an exfiltration tool - Modified Logic
* \[Low] [Uncommon remote scheduled task creation](/analytics-alerts/alerts-by-name/uncommon-remote-scheduled-task-creation.md)
* \[Low] [Uncommon reverse SSH tunnel to external domain/ip](/analytics-alerts/alerts-by-name/uncommon-reverse-ssh-tunnel-to-external-domain-ip.md)
* \[Low] [Uncommon sensitive registry hive dump](/analytics-alerts/alerts-by-name/uncommon-sensitive-registry-hive-dump.md)
* \[Low] [Unprivileged process opened a registry hive](/analytics-alerts/alerts-by-name/unprivileged-process-opened-a-registry-hive.md)
* \[Low] [Unsigned process creates a scheduled task via file access](/analytics-alerts/alerts-by-name/unsigned-process-creates-a-scheduled-task-via-file-access.md)
* \[Low] [Unusual AWS credentials creation](/analytics-alerts/alerts-by-name/unusual-aws-credentials-creation.md)
* \[Low] [Unusual AWS user added to group](/analytics-alerts/alerts-by-name/unusual-aws-user-added-to-group.md)
* \[Low] [Unusual CIM repository file access](/analytics-alerts/alerts-by-name/unusual-cim-repository-file-access.md)
* \[Low] [Unusual Process Spawned by Nginx in Ingress-Nginx pod](/analytics-alerts/alerts-by-name/unusual-process-spawned-by-nginx-in-ingress-nginx-pod.md)
* \[Informational] [Unusual access to the Windows Internal Database on an ADFS server](/analytics-alerts/alerts-by-name/unusual-access-to-the-windows-internal-database-on-an-adfs-server.md)
  * \[Low] Suspicious access to the Windows Internal Database on an ADFS server - Modified Logic
* \[Low] [Unusual compressed file password protection](/analytics-alerts/alerts-by-name/unusual-compressed-file-password-protection.md)
* \[Low] [Unusual process accessed FTP Client credentials](/analytics-alerts/alerts-by-name/unusual-process-accessed-ftp-client-credentials.md)
* \[Low] [Unusual process accessed a crypto wallet's files](/analytics-alerts/alerts-by-name/unusual-process-accessed-a-crypto-wallet-s-files.md)
* \[Low] [Unusual process accessed a messaging app's files](/analytics-alerts/alerts-by-name/unusual-process-accessed-a-messaging-app-s-files.md)
* \[Low] [Unusual process accessed a web browser history file](/analytics-alerts/alerts-by-name/unusual-process-accessed-a-web-browser-history-file.md)
* \[Informational] [User accessed SaaS resource via anonymous link](/analytics-alerts/alerts-by-name/user-accessed-saas-resource-via-anonymous-link.md)
  * \[Low] External user accessed a sensitive SaaS file via anonymous link - Modified Logic
* \[Informational] [Windows CGO, actor and action processes with anomalous characteristics](/analytics-alerts/alerts-by-name/windows-cgo-actor-and-action-processes-with-anomalous-characteristics.md)
  * \[Low] Windows CGO, actor and action processes with highly anomalous characteristics - Modified Logic
* \[Informational] [Windows CGO, actor process and action module with anomalous characteristics](/analytics-alerts/alerts-by-name/windows-cgo-actor-process-and-action-module-with-anomalous-characteristics.md)
  * \[Low] Windows CGO, actor process and action module with very anomalous characteristics - Modified Logic
* \[Low] [Windows Event Log was cleared using wevtutil.exe](/analytics-alerts/alerts-by-name/windows-event-log-was-cleared-using-wevtutil-exe.md)
* \[Informational] [Windows event logs were cleared with PowerShell](/analytics-alerts/alerts-by-name/windows-event-logs-were-cleared-with-powershell.md)
  * \[Low] Windows event logs were cleared with uncommon PowerShell command line - Modified Logic
* \[Low] [WmiPrvSe.exe Rare Child Command Line](/analytics-alerts/alerts-by-name/wmiprvse-exe-rare-child-command-line.md)
* \[Low] [Wsmprovhost.exe Rare Child Process](/analytics-alerts/alerts-by-name/wsmprovhost-exe-rare-child-process.md)
* \[Informational] [A LOLBIN was copied to a different location](/analytics-alerts/alerts-by-name/a-lolbin-was-copied-to-a-different-location.md)
* \[Informational] [A browser extension was installed or loaded in an uncommon way](/analytics-alerts/alerts-by-name/a-browser-extension-was-installed-or-loaded-in-an-uncommon-way.md)
* \[Informational] [A cloud storage configuration was modified](/analytics-alerts/alerts-by-name/a-cloud-storage-configuration-was-modified.md)
* \[Informational] [A compressed file was exfiltrated over SSH](/analytics-alerts/alerts-by-name/a-compressed-file-was-exfiltrated-over-ssh.md)
* \[Informational] [A non-browser process accessed a website UI](/analytics-alerts/alerts-by-name/a-non-browser-process-accessed-a-website-ui.md)
* \[Informational] [A process connected to a rare cloud resource](/analytics-alerts/alerts-by-name/a-process-connected-to-a-rare-cloud-resource.md)
  * \[Informational] A process connected to a rare cloud resource atypical to this agent - Modified Logic
  * \[Informational] A process connected to an atypical rare cloud resource - Modified Logic
* \[Informational] [A process connected to rare external host](/analytics-alerts/alerts-by-name/a-process-connected-to-rare-external-host.md)
* \[Informational] [A process is masquerading as a common Microsoft product](/analytics-alerts/alerts-by-name/a-process-is-masquerading-as-a-common-microsoft-product.md)
* \[Informational] [A process modified an SSH authorized\_keys file](/analytics-alerts/alerts-by-name/a-process-modified-an-ssh-authorized-keys-file.md)
* \[Informational] [A service was disabled](/analytics-alerts/alerts-by-name/a-service-was-disabled.md)
* \[Informational] [A third-party utility was copied to a different location](/analytics-alerts/alerts-by-name/a-third-party-utility-was-copied-to-a-different-location.md)
* \[Informational] [A user connected from a new country](/analytics-alerts/alerts-by-name/a-user-connected-from-a-new-country.md)
* \[Informational] [AI-determined combination of risky alerts under the same actor process](/analytics-alerts/alerts-by-name/ai-determined-combination-of-risky-alerts-under-the-same-actor-process.md)
* \[Informational] [AWS SSM send command attempt](/analytics-alerts/alerts-by-name/aws-ssm-send-command-attempt.md)
* \[Informational] [Access to Kubernetes configuration file](/analytics-alerts/alerts-by-name/access-to-kubernetes-configuration-file.md)
* \[Informational] [Adding execution privileges](/analytics-alerts/alerts-by-name/adding-execution-privileges.md)
* \[Informational] [An AWS database service master user password was changed](/analytics-alerts/alerts-by-name/an-aws-database-service-master-user-password-was-changed.md)
* \[Informational] [An identity accessed a backup cloud storage](/analytics-alerts/alerts-by-name/an-identity-accessed-a-backup-cloud-storage.md)
* \[Informational] [An identity accessed a cloud storage for the first time](/analytics-alerts/alerts-by-name/an-identity-accessed-a-cloud-storage-for-the-first-time.md)
* \[Informational] [An uncommon file was created in the startup folder](/analytics-alerts/alerts-by-name/an-uncommon-file-was-created-in-the-startup-folder.md)
* \[Informational] [An uncommon lolbin execution by scheduled task](/analytics-alerts/alerts-by-name/an-uncommon-lolbin-execution-by-scheduled-task.md)
* \[Informational] [AppleScript executed a shell script](/analytics-alerts/alerts-by-name/applescript-executed-a-shell-script.md)
* \[Informational] [AppleScript process executed with a rare command line](/analytics-alerts/alerts-by-name/applescript-process-executed-with-a-rare-command-line.md)
* \[Informational] [Browser bookmark files accessed by a rare non-browser process](/analytics-alerts/alerts-by-name/browser-bookmark-files-accessed-by-a-rare-non-browser-process.md)
* \[Informational] [Cloud storage automatic backup disabled](/analytics-alerts/alerts-by-name/cloud-storage-automatic-backup-disabled.md)
* \[Informational] [Cloud storage delete protection disabled](/analytics-alerts/alerts-by-name/cloud-storage-delete-protection-disabled.md)
* \[Informational] [Command execution in a Kubernetes pod](/analytics-alerts/alerts-by-name/command-execution-in-a-kubernetes-pod.md)
* \[Informational] [Command execution via wmiexec](/analytics-alerts/alerts-by-name/command-execution-via-wmiexec.md)
* \[Informational] [Creation or modification of the default command executed when opening an application](/analytics-alerts/alerts-by-name/creation-or-modification-of-the-default-command-executed-when-opening-an-application.md)
* \[Informational] [Data encryption was disabled](/analytics-alerts/alerts-by-name/data-encryption-was-disabled.md)
* \[Informational] [Discovery of host users via WMIC](/analytics-alerts/alerts-by-name/discovery-of-host-users-via-wmic.md)
* \[Informational] [Display text URL differs from actual URL](/analytics-alerts/alerts-by-name/display-text-url-differs-from-actual-url.md)
* \[Informational] [Email attachment with a potentially malicious file extension](/analytics-alerts/alerts-by-name/email-attachment-with-a-potentially-malicious-file-extension.md)
* \[Informational] [Email attachment(s) with potentially malicious MIME type](/analytics-alerts/alerts-by-name/email-attachment-s-with-potentially-malicious-mime-type.md)
* \[Informational] [Email containing a link with an IP address convention was detected](/analytics-alerts/alerts-by-name/email-containing-a-link-with-an-ip-address-convention-was-detected.md)
* \[Informational] [Email containing a redirected link](/analytics-alerts/alerts-by-name/email-containing-a-redirected-link.md)
* \[Informational] [Email marked as spam and bulk based on Spam Confidence Level and Bulk Complaint Level values](/analytics-alerts/alerts-by-name/email-marked-as-spam-and-bulk-based-on-spam-confidence-level-and-bulk-complaint-level-values.md)
* \[Informational] [Email mimics replies or forwards without an actual ongoing conversation](/analytics-alerts/alerts-by-name/email-mimics-replies-or-forwards-without-an-actual-ongoing-conversation.md)
* \[Informational] [Email was received from an unknown address using a public provider domain](/analytics-alerts/alerts-by-name/email-was-received-from-an-unknown-address-using-a-public-provider-domain.md)
* \[Informational] [Email with URL shortener detected](/analytics-alerts/alerts-by-name/email-with-url-shortener-detected.md)
* \[Informational] [Exchange compliance search created](/analytics-alerts/alerts-by-name/exchange-compliance-search-created.md)
* \[Informational] [Exchange email-hiding inbox rule](/analytics-alerts/alerts-by-name/exchange-email-hiding-inbox-rule.md)
* \[Informational] [Exchange email-hiding transport rule](/analytics-alerts/alerts-by-name/exchange-email-hiding-transport-rule.md)
* \[Informational] [Exchange mailbox folder permission modification](/analytics-alerts/alerts-by-name/exchange-mailbox-folder-permission-modification.md)
* \[Informational] [Executable moved to Windows system folder](/analytics-alerts/alerts-by-name/executable-moved-to-windows-system-folder.md)
* \[Informational] [Execution of an uncommon process at an early startup stage](/analytics-alerts/alerts-by-name/execution-of-an-uncommon-process-at-an-early-startup-stage.md)
* \[Informational] [Execution of an uncommon process with a local/domain user SID at an early startup stage](/analytics-alerts/alerts-by-name/execution-of-an-uncommon-process-with-a-local-domain-user-sid-at-an-early-startup-stage.md)
* \[Informational] [Execution of renamed lolbin](/analytics-alerts/alerts-by-name/execution-of-renamed-lolbin.md)
* \[Informational] [External SaaS file-sharing activity](/analytics-alerts/alerts-by-name/external-saas-file-sharing-activity.md)
* \[Informational] [External email display name impersonation of internal personnel](/analytics-alerts/alerts-by-name/external-email-display-name-impersonation-of-internal-personnel.md)
* \[Informational] [External email with a single internal recipient hidden in BCC](/analytics-alerts/alerts-by-name/external-email-with-a-single-internal-recipient-hidden-in-bcc.md)
* \[Informational] [External user created a Microsoft Teams conversation with suspicious operations](/analytics-alerts/alerts-by-name/external-user-created-a-microsoft-teams-conversation-with-suspicious-operations.md)
* \[Informational] [First SSO Resource Access in the Organization](/analytics-alerts/alerts-by-name/first-sso-resource-access-in-the-organization.md)
* \[Informational] [First SSO access from ASN for user](/analytics-alerts/alerts-by-name/first-sso-access-from-asn-for-user.md)
* \[Informational] [First-time attachment exchange](/analytics-alerts/alerts-by-name/first-time-attachment-exchange.md)
* \[Informational] [Indicator blocking](/analytics-alerts/alerts-by-name/indicator-blocking.md)
* \[Informational] [Initial person-to-person email contact](/analytics-alerts/alerts-by-name/initial-person-to-person-email-contact.md)
* \[Informational] [Injection into rundll32.exe](/analytics-alerts/alerts-by-name/injection-into-rundll32-exe.md)
* \[Informational] [Intense SSO failures](/analytics-alerts/alerts-by-name/intense-sso-failures.md)
* \[Informational] [Kubernetes Pod Created With Sensitive Volume](/analytics-alerts/alerts-by-name/kubernetes-pod-created-with-sensitive-volume.md)
* \[Informational] [Kubernetes Pod Created with host Inter Process Communications (IPC) namespace](/analytics-alerts/alerts-by-name/kubernetes-pod-created-with-host-inter-process-communications-ipc-namespace.md)
* \[Informational] [Kubernetes Pod created with host process ID (PID) namespace](/analytics-alerts/alerts-by-name/kubernetes-pod-created-with-host-process-id-pid-namespace.md)
* \[Informational] [Kubernetes Privileged Pod Creation](/analytics-alerts/alerts-by-name/kubernetes-privileged-pod-creation.md)
* \[Informational] [Kubernetes pod creation with host network](/analytics-alerts/alerts-by-name/kubernetes-pod-creation-with-host-network.md)
* \[Informational] [LOLBAS executable injects into another process](/analytics-alerts/alerts-by-name/lolbas-executable-injects-into-another-process.md)
* \[Informational] [LOLBIN created a PSScriptPolicyTest PowerShell script file](/analytics-alerts/alerts-by-name/lolbin-created-a-psscriptpolicytest-powershell-script-file.md)
* \[Informational] [Linux local user account creation](/analytics-alerts/alerts-by-name/linux-local-user-account-creation.md)
* \[Informational] [Linux network share discovery](/analytics-alerts/alerts-by-name/linux-network-share-discovery.md)
* \[Informational] [Local account discovery](/analytics-alerts/alerts-by-name/local-account-discovery.md)
* \[Informational] [Local group enumeration](/analytics-alerts/alerts-by-name/local-group-enumeration.md)
* \[Informational] [Local group enumeration via RPC](/analytics-alerts/alerts-by-name/local-group-enumeration-via-rpc.md)
* \[Informational] [Massive file activity abnormal to process](/analytics-alerts/alerts-by-name/massive-file-activity-abnormal-to-process.md)
* \[Informational] [Massive file downloads from SaaS service](/analytics-alerts/alerts-by-name/massive-file-downloads-from-saas-service.md)
* \[Informational] [Massive files deletion in Box](/analytics-alerts/alerts-by-name/massive-files-deletion-in-box.md)
* \[Informational] [Massive files deletion in Dropbox](/analytics-alerts/alerts-by-name/massive-files-deletion-in-dropbox.md)
* \[Informational] [Massive files deletion in Google Drive](/analytics-alerts/alerts-by-name/massive-files-deletion-in-google-drive.md)
* \[Informational] [Massive files deletion in Microsoft SharePoint or OneDrive](/analytics-alerts/alerts-by-name/massive-files-deletion-in-microsoft-sharepoint-or-onedrive.md)
* \[Informational] [Massive upload to SaaS service](/analytics-alerts/alerts-by-name/massive-upload-to-saas-service.md)
* \[Informational] [Modification of PAM](/analytics-alerts/alerts-by-name/modification-of-pam.md)
* \[Informational] [Modification of the AD FS IdentityServer configuration file](/analytics-alerts/alerts-by-name/modification-of-the-ad-fs-identityserver-configuration-file.md)
* \[Informational] [Moniker link detected in URL(s)](/analytics-alerts/alerts-by-name/moniker-link-detected-in-url-s.md)
* \[Informational] [Msiexec execution of an executable from an uncommon remote location](/analytics-alerts/alerts-by-name/msiexec-execution-of-an-executable-from-an-uncommon-remote-location.md)
* \[Informational] [Multiple discovery commands on a Linux host by the same process](/analytics-alerts/alerts-by-name/multiple-discovery-commands-on-a-linux-host-by-the-same-process.md)
* \[Informational] [Multiple discovery-like commands](/analytics-alerts/alerts-by-name/multiple-discovery-like-commands.md)
* \[Informational] [Near-empty email from an external sender](/analytics-alerts/alerts-by-name/near-empty-email-from-an-external-sender.md)
* \[Informational] [Numerous emails sent by a single sender to multiple internal recipients](/analytics-alerts/alerts-by-name/numerous-emails-sent-by-a-single-sender-to-multiple-internal-recipients.md)
* \[Informational] [Outbound email to an address hosted by a public email service provider](/analytics-alerts/alerts-by-name/outbound-email-to-an-address-hosted-by-a-public-email-service-provider.md)
* \[Informational] [Permission Groups discovery commands](/analytics-alerts/alerts-by-name/permission-groups-discovery-commands.md)
* \[Informational] [Possible DLL Hijack into a Microsoft process](/analytics-alerts/alerts-by-name/possible-dll-hijack-into-a-microsoft-process.md)
  * \[Informational] Possible DLL Side-Loading into a Microsoft process from a suspicious folder - Modified Logic
* \[Informational] [Possible Email collection using Outlook RPC](/analytics-alerts/alerts-by-name/possible-email-collection-using-outlook-rpc.md)
* \[Informational] [Possible binary padding using dd](/analytics-alerts/alerts-by-name/possible-binary-padding-using-dd.md)
* \[Informational] [Possible data exfiltration over a USB storage device](/analytics-alerts/alerts-by-name/possible-data-exfiltration-over-a-usb-storage-device.md)
* \[Informational] [Possible data obfuscation](/analytics-alerts/alerts-by-name/possible-data-obfuscation.md)
* \[Informational] [Potential spoofing of internal domain spotted](/analytics-alerts/alerts-by-name/potential-spoofing-of-internal-domain-spotted.md)
* \[Informational] [PsExec was executed with a suspicious command line](/analytics-alerts/alerts-by-name/psexec-was-executed-with-a-suspicious-command-line.md)
* \[Informational] [Punycode characters detected in URL(s)](/analytics-alerts/alerts-by-name/punycode-characters-detected-in-url-s.md)
* \[Informational] [Python HTTP server started](/analytics-alerts/alerts-by-name/python-http-server-started.md)
* \[Informational] [Quarantined email released to recipients](/analytics-alerts/alerts-by-name/quarantined-email-released-to-recipients.md)
* \[Informational] [Rare LOLBIN Process Execution by User](/analytics-alerts/alerts-by-name/rare-lolbin-process-execution-by-user.md)
* \[Informational] [Rare Unix process divided files by size](/analytics-alerts/alerts-by-name/rare-unix-process-divided-files-by-size.md)
* \[Informational] [Rare process accessed a Keychain file](/analytics-alerts/alerts-by-name/rare-process-accessed-a-keychain-file.md)
* \[Informational] [Rarely seen sender address in the organization](/analytics-alerts/alerts-by-name/rarely-seen-sender-address-in-the-organization.md)
* \[Informational] [Rarely seen sender domain in the organization](/analytics-alerts/alerts-by-name/rarely-seen-sender-domain-in-the-organization.md)
* \[Informational] [Remote PsExec-like command execution](/analytics-alerts/alerts-by-name/remote-psexec-like-command-execution.md)
* \[Informational] [Run downloaded script using pipe](/analytics-alerts/alerts-by-name/run-downloaded-script-using-pipe.md)
* \[Informational] [SSO Brute Force](/analytics-alerts/alerts-by-name/sso-brute-force.md)
* \[Informational] [SSO Password Spray](/analytics-alerts/alerts-by-name/sso-password-spray.md)
* \[Informational] [SSO with abnormal operating system](/analytics-alerts/alerts-by-name/sso-with-abnormal-operating-system.md)
* \[Informational] [SSO with abnormal user agent](/analytics-alerts/alerts-by-name/sso-with-abnormal-user-agent.md)
* \[Informational] [SSO with new operating system](/analytics-alerts/alerts-by-name/sso-with-new-operating-system.md)
* \[Informational] [Security tools detection attempt](/analytics-alerts/alerts-by-name/security-tools-detection-attempt.md)
* \[Informational] [Sensitive Exchange mail sent to external users](/analytics-alerts/alerts-by-name/sensitive-exchange-mail-sent-to-external-users.md)
* \[Informational] [Service execution via sc.exe](/analytics-alerts/alerts-by-name/service-execution-via-sc-exe.md)
* \[Informational] [Signed process creates a scheduled task via file access](/analytics-alerts/alerts-by-name/signed-process-creates-a-scheduled-task-via-file-access.md)
* \[Informational] [Single IP accessed mail items of multiple users](/analytics-alerts/alerts-by-name/single-ip-accessed-mail-items-of-multiple-users.md)
* \[Informational] [Space after filename](/analytics-alerts/alerts-by-name/space-after-filename.md)
* \[Informational] [Suspicious AMSI decode attempt](/analytics-alerts/alerts-by-name/suspicious-amsi-decode-attempt.md)
* \[Informational] [Suspicious DKIM Result](/analytics-alerts/alerts-by-name/suspicious-dkim-result.md)
* \[Informational] [Suspicious DMARC result](/analytics-alerts/alerts-by-name/suspicious-dmarc-result.md)
* \[Informational] [Suspicious SPF Result](/analytics-alerts/alerts-by-name/suspicious-spf-result.md)
* \[Informational] [Suspicious Unicode character detected in email](/analytics-alerts/alerts-by-name/suspicious-unicode-character-detected-in-email.md)
* \[Informational] [Suspicious active setup registered](/analytics-alerts/alerts-by-name/suspicious-active-setup-registered.md)
* \[Informational] [Suspicious brand affiliation detected](/analytics-alerts/alerts-by-name/suspicious-brand-affiliation-detected.md)
* \[Informational] [Suspicious container reconnaissance activity in a Kubernetes pod](/analytics-alerts/alerts-by-name/suspicious-container-reconnaissance-activity-in-a-kubernetes-pod.md)
* \[Informational] [Suspicious container runtime connection from within a Kubernetes Pod](/analytics-alerts/alerts-by-name/suspicious-container-runtime-connection-from-within-a-kubernetes-pod.md)
* \[Informational] [Suspicious curl user agent](/analytics-alerts/alerts-by-name/suspicious-curl-user-agent.md)
* \[Informational] [Suspicious process executed with a high integrity level](/analytics-alerts/alerts-by-name/suspicious-process-executed-with-a-high-integrity-level.md)
* \[Informational] [Suspicious proxy environment variable setting](/analytics-alerts/alerts-by-name/suspicious-proxy-environment-variable-setting.md)
* \[Informational] [Suspicious sender exhibiting automated sending patterns](/analytics-alerts/alerts-by-name/suspicious-sender-exhibiting-automated-sending-patterns.md)
* \[Informational] [Suspicious sending domain with sender address randomization](/analytics-alerts/alerts-by-name/suspicious-sending-domain-with-sender-address-randomization.md)
* \[Informational] [Suspicious usage of Microsoft's Active Directory PowerShell module remote discovery cmdlet](/analytics-alerts/alerts-by-name/suspicious-usage-of-microsoft-s-active-directory-powershell-module-remote-discovery-cmdlet.md)
* \[Informational] [Tampering with Internet Explorer Protected Mode configuration](/analytics-alerts/alerts-by-name/tampering-with-internet-explorer-protected-mode-configuration.md)
* \[Informational] [Tampering with the Windows User Account Controls (UAC) configuration](/analytics-alerts/alerts-by-name/tampering-with-the-windows-user-account-controls-uac-configuration.md)
* \[Informational] [Uncommon AppleScript designed to access cryptocurrency wallet data was executed via the command line](/analytics-alerts/alerts-by-name/uncommon-applescript-designed-to-access-cryptocurrency-wallet-data-was-executed-via-the-command-line.md)
* \[Informational] [Uncommon Linux remote shell command execution](/analytics-alerts/alerts-by-name/uncommon-linux-remote-shell-command-execution.md)
* \[Informational] [Uncommon Linux shell command execution](/analytics-alerts/alerts-by-name/uncommon-linux-shell-command-execution.md)
* \[Informational] [Uncommon access to Microsoft Teams cookies files](/analytics-alerts/alerts-by-name/uncommon-access-to-microsoft-teams-cookies-files.md)
* \[Informational] [Uncommon access to cloud platforms' sensitive files by a scripting engine](/analytics-alerts/alerts-by-name/uncommon-access-to-cloud-platforms-sensitive-files-by-a-scripting-engine.md)
* \[Informational] [Uncommon attempt at discovering a sensitive file](/analytics-alerts/alerts-by-name/uncommon-attempt-at-discovering-a-sensitive-file.md)
* \[Informational] [Uncommon attempt at grabbing credentials from a sensitive file](/analytics-alerts/alerts-by-name/uncommon-attempt-at-grabbing-credentials-from-a-sensitive-file.md)
* \[Informational] [Uncommon cloud CLI tool usage](/analytics-alerts/alerts-by-name/uncommon-cloud-cli-tool-usage.md)
* \[Informational] [Uncommon command was executed on a device](/analytics-alerts/alerts-by-name/uncommon-command-was-executed-on-a-device.md)
* \[Informational] [Uncommon communication to an instant messaging server](/analytics-alerts/alerts-by-name/uncommon-communication-to-an-instant-messaging-server.md)
* \[Informational] [Uncommon kernel module load](/analytics-alerts/alerts-by-name/uncommon-kernel-module-load.md)
* \[Informational] [Uncommon local scheduled task creation via schtasks.exe](/analytics-alerts/alerts-by-name/uncommon-local-scheduled-task-creation-via-schtasks-exe.md)
* \[Informational] [Uncommon login item persistency was registered or modified](/analytics-alerts/alerts-by-name/uncommon-login-item-persistency-was-registered-or-modified.md)
* \[Informational] [Uncommon macOS shell command execution](/analytics-alerts/alerts-by-name/uncommon-macos-shell-command-execution.md)
* \[Informational] [Uncommon net group command execution](/analytics-alerts/alerts-by-name/uncommon-net-group-command-execution.md)
* \[Informational] [Uncommon network tunnel creation](/analytics-alerts/alerts-by-name/uncommon-network-tunnel-creation.md)
* \[Informational] [Uncommon sensitive filesystem registry hive access](/analytics-alerts/alerts-by-name/uncommon-sensitive-filesystem-registry-hive-access.md)
* \[Informational] [Uncommon service stop operation](/analytics-alerts/alerts-by-name/uncommon-service-stop-operation.md)
* \[Informational] [Uncommon signed process execution by scheduled task](/analytics-alerts/alerts-by-name/uncommon-signed-process-execution-by-scheduled-task.md)
* \[Informational] [Unknown DLL was added to the AD FS Global Assembly Cache path](/analytics-alerts/alerts-by-name/unknown-dll-was-added-to-the-ad-fs-global-assembly-cache-path.md)
* \[Informational] [Unrecognized internal address (AAD mismatch)](/analytics-alerts/alerts-by-name/unrecognized-internal-address-aad-mismatch.md)
* \[Informational] [Untrusted process contacted LLM API](/analytics-alerts/alerts-by-name/untrusted-process-contacted-llm-api.md)
* \[Informational] [Unusual DB process spawning a shell](/analytics-alerts/alerts-by-name/unusual-db-process-spawning-a-shell.md)
* \[Informational] [Unusual URL(s) sent by a brand were observed in the email](/analytics-alerts/alerts-by-name/unusual-url-s-sent-by-a-brand-were-observed-in-the-email.md)
* \[Informational] [Unusual access to the AD Sync credential files](/analytics-alerts/alerts-by-name/unusual-access-to-the-ad-sync-credential-files.md)
* \[Informational] [Unusual display name in From header](/analytics-alerts/alerts-by-name/unusual-display-name-in-from-header.md)
* \[Informational] [Unusual hostname for the sending mail server in the email headers](/analytics-alerts/alerts-by-name/unusual-hostname-for-the-sending-mail-server-in-the-email-headers.md)
* \[Informational] [Unusual process accessed a macOS notes DB file](/analytics-alerts/alerts-by-name/unusual-process-accessed-a-macos-notes-db-file.md)
* \[Informational] [Unusual process accessed web browser cookies](/analytics-alerts/alerts-by-name/unusual-process-accessed-web-browser-cookies.md)
* \[Informational] [Unusual process accessed web browser credentials](/analytics-alerts/alerts-by-name/unusual-process-accessed-web-browser-credentials.md)
* \[Informational] [Unusual sender IP subnet](/analytics-alerts/alerts-by-name/unusual-sender-ip-subnet.md)
  * \[Informational] Unusual sender IP subnet associated with internal sender - Modified Logic
* \[Informational] [Unusual use of a 'SysInternals' tool](/analytics-alerts/alerts-by-name/unusual-use-of-a-sysinternals-tool.md)
* \[Informational] [Usage of homograph characters detected in an email attachment(s) name](/analytics-alerts/alerts-by-name/usage-of-homograph-characters-detected-in-an-email-attachment-s-name.md)
* \[Informational] [User accessed multiple O365 AIP sensitive files](/analytics-alerts/alerts-by-name/user-accessed-multiple-o365-aip-sensitive-files.md)
* \[Informational] [User attempted to connect from a suspicious country](/analytics-alerts/alerts-by-name/user-attempted-to-connect-from-a-suspicious-country.md)
* \[Informational] [User mail items accessed from multiple IPs in the same subnet](/analytics-alerts/alerts-by-name/user-mail-items-accessed-from-multiple-ips-in-the-same-subnet.md)
* \[Informational] [User moved Exchange sent messages to deleted items](/analytics-alerts/alerts-by-name/user-moved-exchange-sent-messages-to-deleted-items.md)
* \[Informational] [VM Detection attempt](/analytics-alerts/alerts-by-name/vm-detection-attempt.md)
* \[Informational] [VM Detection attempt on Linux](/analytics-alerts/alerts-by-name/vm-detection-attempt-on-linux.md)
* \[Informational] [Web server CGO executed an uncommon process](/analytics-alerts/alerts-by-name/web-server-cgo-executed-an-uncommon-process.md)
* \[Informational] [Well-known brand in sender headers with header inconsistencies](/analytics-alerts/alerts-by-name/well-known-brand-in-sender-headers-with-header-inconsistencies.md)

### Modified Metadata

* \[Low] [A rare FTP user has been detected on an existing FTP server](/analytics-alerts/alerts-by-name/a-rare-ftp-user-has-been-detected-on-an-existing-ftp-server.md)
* \[Informational -> Low] [AWS Password Policy Discovery](/analytics-alerts/alerts-by-name/aws-password-policy-discovery.md)
* \[Informational -> Low] [An AWS S3 bucket configuration was modified](/analytics-alerts/alerts-by-name/an-aws-s3-bucket-configuration-was-modified.md)
* \[Informational -> Low] [Azure Blob Container Access Level Modification](/analytics-alerts/alerts-by-name/azure-blob-container-access-level-modification.md)
* \[Informational -> Low] [Bucket's object ownership controls were modified](/analytics-alerts/alerts-by-name/bucket-s-object-ownership-controls-were-modified.md)
* \[Low] [FTP Connection Using an Anonymous Login or Default Credentials](/analytics-alerts/alerts-by-name/ftp-connection-using-an-anonymous-login-or-default-credentials.md)
* \[Low] [Large Upload (FTP)](/analytics-alerts/alerts-by-name/large-upload-ftp.md)
* \[Low] [Multiple Suspicious FTP Login Attempts](/analytics-alerts/alerts-by-name/multiple-suspicious-ftp-login-attempts.md)
* \[Low] [New FTP Server](/analytics-alerts/alerts-by-name/new-ftp-server.md)
* \[Informational -> Low] [Potential creation of persistent cloud credentials](/analytics-alerts/alerts-by-name/potential-creation-of-persistent-cloud-credentials.md)
* \[Medium -> Low] [Python script connecting to network](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/python-script-connecting-to-network)
* \[Informational -> Low] [Unusual AWS CLI/SDK activity](/analytics-alerts/alerts-by-name/unusual-aws-cli-sdk-activity.md)

### Temporarily Removed

* \[Informational] Azure device code authentication flow used
  * \[Medium] Suspicious Azure device code authentication flow used by an Azure AD privileged user
  * \[Low] Azure device code authentication flow used by an Azure AD privileged user
  * \[Low] Suspicious Azure device code authentication flow used


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-09-23.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.