> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-09-30.md).

# 2026.09.30

### Release date: 18-October-2026

### Summary

#### Added

* **10 Detectors:** 1 Medium, 1 Low, 8 Informational
* **15 Variations:** 2 High, 2 Medium, 11 Low

#### Removed

* **2 Detectors:** 1 Low, 1 Informational
* **4 Variations:** 1 High, 1 Medium, 2 Low

#### Modified Logic

* **53 Detectors:** 3 Medium, 13 Low, 37 Informational
* **11 Variations:** 4 High, 3 Medium, 4 Low

#### Modified Metadata

* **15 Detectors:** 1 High, 1 Medium, 13 Informational
* **1 Variation:** 1 High

### Added

* \[Medium] [Harvesting multiple Kubernetes pod tokens from within a Kubernetes pod](/analytics-alerts/alerts-by-name/harvesting-multiple-kubernetes-pod-tokens-from-within-a-kubernetes-pod.md)
  * \[High] Harvesting multiple Kubernetes pod tokens from within a Kubernetes pod via an interactive shell
* \[Informational] [Rare scheduled task created](/analytics-alerts/alerts-by-name/rare-scheduled-task-created.md)
  * \[High] Rare scheduled task created by an injected actor
  * \[Medium] Uncommon remote scheduled task created
  * \[Low] Highly rare scheduled task created
  * \[Low] Rare masquerading scheduled task created
  * \[Low] Uncommon local scheduled task created
* \[Informational] [Kubernetes RBAC enumeration](/analytics-alerts/alerts-by-name/kubernetes-rbac-enumeration.md)
  * \[Medium] Kubernetes RBAC enumeration by an unfamiliar client that also modifies RBAC
  * \[Low] Kubernetes RBAC enumeration by an unfamiliar client
* \[Low] [64-bit PowerShell spawning an uncommon 32-bit PowerShell](/analytics-alerts/alerts-by-name/64-bit-powershell-spawning-an-uncommon-32-bit-powershell.md)
* \[Informational] [A user authenticated successfully via SSO from a suspicious tunnel operator](/analytics-alerts/alerts-by-name/a-user-authenticated-successfully-via-sso-from-a-suspicious-tunnel-operator.md)
  * \[Low] First time Successful SSO sign-in via suspicious tunnel operator for user
* \[Informational] [First seen Resent-From address in the organization](/analytics-alerts/alerts-by-name/first-seen-resent-from-address-in-the-organization.md)
  * \[Low] First-seen Resent-From address from a public email provider
  * \[Low] First-seen Resent-From distribution list in the organization
  * \[Low] First-seen Resent-From internal address in the organization
* \[Informational] [High-volume resent emails from various sources](/analytics-alerts/alerts-by-name/high-volume-resent-emails-from-various-sources.md)
  * \[Low] High-volume resent emails from various sources (massive scale)
* \[Informational] [Successful SSO authentication from a suspicious tunnel operator](/analytics-alerts/alerts-by-name/successful-sso-authentication-from-a-suspicious-tunnel-operator.md)
  * \[Low] Successful SSO sign-in from a suspicious tunnel operator with high-risk characteristics
* \[Informational] [Unusual app.n8n.cloud URL(s) in email](/analytics-alerts/alerts-by-name/unusual-app-n8n-cloud-url-s-in-email.md)
  * \[Low] Unusual app.n8n.cloud URL(s) in email for organization
* \[Informational] [Uncommon command executed on a virtualization host](/analytics-alerts/alerts-by-name/uncommon-command-executed-on-a-virtualization-host.md)

### Removed

* \[Informational] Rare scheduled task created
  * \[High] Rare scheduled task created by an injected actor
  * \[Medium] Uncommon remote scheduled task created
  * \[Low] Highly rare scheduled task created
  * \[Low] Uncommon local scheduled task created
* \[Low] 64-bit PowerShell spawning a 32-bit PowerShell

### Modified Logic

* \[Low] [Uncommon driver loaded](/analytics-alerts/alerts-by-name/uncommon-driver-loaded.md)
  * \[High] Globally rare and unsigned driver loaded from a non-standard path - Added
  * \[High] Known malicious driver loaded - Added
  * \[High] Uncommon and known vulnerable driver loaded - Added
  * \[High] Uncommon driver loaded by a Web server process - Modified Metadata
  * \[Medium] Uncommon driver loaded from a non-standard path - Added
  * \[Medium] Uncommon driver with a globally rare vendor loaded as a service - Modified Metadata
* \[Medium] [Cloud snapshot of a database or storage instance was publicly shared](/analytics-alerts/alerts-by-name/cloud-snapshot-of-a-database-or-storage-instance-was-publicly-shared.md)
* \[Medium] [Potential Phishing has been detected](/analytics-alerts/alerts-by-name/potential-phishing-has-been-detected.md)
* \[Medium] [S3 public exposure followed by data access](/analytics-alerts/alerts-by-name/s3-public-exposure-followed-by-data-access.md)
* \[Informational] [Suspicious container runtime connection from within a Kubernetes Pod](/analytics-alerts/alerts-by-name/suspicious-container-runtime-connection-from-within-a-kubernetes-pod.md)
  * \[Medium] Suspicious container runtime connection from within a Kubernetes Pod using the docker client - Modified Logic
* \[Low] [AWS S3 bucket or object was exposed to public access](/analytics-alerts/alerts-by-name/aws-s3-bucket-or-object-was-exposed-to-public-access.md)
* \[Low] [Abnormal RDP connections to multiple hosts from a rarely seen host](/analytics-alerts/alerts-by-name/abnormal-rdp-connections-to-multiple-hosts-from-a-rarely-seen-host.md)
* \[Low] [Abnormal RDP session to a remote host from a rarely seen host](/analytics-alerts/alerts-by-name/abnormal-rdp-session-to-a-remote-host-from-a-rarely-seen-host.md)
* \[Low] [Abnormal sensitive RPC traffic to multiple hosts from a rarely seen host](/analytics-alerts/alerts-by-name/abnormal-sensitive-rpc-traffic-to-multiple-hosts-from-a-rarely-seen-host.md)
* \[Low] [An AWS S3 bucket configuration was modified](/analytics-alerts/alerts-by-name/an-aws-s3-bucket-configuration-was-modified.md)
* \[Low] [An S3 replication policy to an unknown bucket was created](/analytics-alerts/alerts-by-name/an-s3-replication-policy-to-an-unknown-bucket-was-created.md)
* \[Low] [Azure Blob Container Access Level Modification](/analytics-alerts/alerts-by-name/azure-blob-container-access-level-modification.md)
* \[Low] [Bucket's object ownership controls were modified](/analytics-alerts/alerts-by-name/bucket-s-object-ownership-controls-were-modified.md)
* \[Low] [New cloud identity created with administrative policy](/analytics-alerts/alerts-by-name/new-cloud-identity-created-with-administrative-policy.md)
* \[Low] [Rare Scheduled Task RPC activity from a rarely seen host](/analytics-alerts/alerts-by-name/rare-scheduled-task-rpc-activity-from-a-rarely-seen-host.md)
* \[Low] [Rare unsigned process execution by scheduled task](/analytics-alerts/alerts-by-name/rare-unsigned-process-execution-by-scheduled-task.md)
  * \[Low] Process, with a rare untrusted signature, execution by scheduled task - Added
  * \[Low] Rare unsigned process execution from a suspicious folder by scheduled task - Added
  * \[Low] Rare unsigned process execution with high entropy by scheduled task - Added
  * \[Medium -> Low] Rare unsigned process execution with high integrity level by scheduled task - Modified Logic
* \[Low] [Suspicious cloud user data modification attempt followed by VM restart](/analytics-alerts/alerts-by-name/suspicious-cloud-user-data-modification-attempt-followed-by-vm-restart.md)
* \[Informational] [A cloud instance was stopped](/analytics-alerts/alerts-by-name/a-cloud-instance-was-stopped.md)
* \[Informational] [A cloud snapshot of AWS database or storage was modified or shared](/analytics-alerts/alerts-by-name/a-cloud-snapshot-of-aws-database-or-storage-was-modified-or-shared.md)
* \[Informational] [A cloud storage configuration was modified](/analytics-alerts/alerts-by-name/a-cloud-storage-configuration-was-modified.md)
* \[Informational] [AI-determined combination of risky alerts under the same actor process](/analytics-alerts/alerts-by-name/ai-determined-combination-of-risky-alerts-under-the-same-actor-process.md)
* \[Informational] [AI-determined combination of risky alerts under the same causality](/analytics-alerts/alerts-by-name/ai-determined-combination-of-risky-alerts-under-the-same-causality.md)
* \[Informational] [AWS EC2 instance exported into S3](/analytics-alerts/alerts-by-name/aws-ec2-instance-exported-into-s3.md)
* \[Informational] [AWS SSM parameters retrieval](/analytics-alerts/alerts-by-name/aws-ssm-parameters-retrieval.md)
* \[Informational] [AWS user creation](/analytics-alerts/alerts-by-name/aws-user-creation.md)
* \[Informational] [An AWS EC2 instance was exported into an unknown S3 bucket](/analytics-alerts/alerts-by-name/an-aws-ec2-instance-was-exported-into-an-unknown-s3-bucket.md)
* \[Informational] [An AWS Lambda function was modified](/analytics-alerts/alerts-by-name/an-aws-lambda-function-was-modified.md)
* \[Informational] [An identity disabled bucket logging](/analytics-alerts/alerts-by-name/an-identity-disabled-bucket-logging.md)
* \[Informational] [Bucket's block public access setting disabled or deleted](/analytics-alerts/alerts-by-name/bucket-s-block-public-access-setting-disabled-or-deleted.md)
* \[Informational] [Cloud access key creation](/analytics-alerts/alerts-by-name/cloud-access-key-creation.md)
* \[Informational] [Cloud resource logging was disabled](/analytics-alerts/alerts-by-name/cloud-resource-logging-was-disabled.md)
* \[Informational] [Cloud snapshot created or modified](/analytics-alerts/alerts-by-name/cloud-snapshot-created-or-modified.md)
* \[Informational] [Cloud storage delete protection disabled](/analytics-alerts/alerts-by-name/cloud-storage-delete-protection-disabled.md)
* \[Informational] [Data encryption was disabled](/analytics-alerts/alerts-by-name/data-encryption-was-disabled.md)
* \[Informational] [Foreign account was granted permissions to S3 bucket via resource-based policy](/analytics-alerts/alerts-by-name/foreign-account-was-granted-permissions-to-s3-bucket-via-resource-based-policy.md)
* \[Informational] [GCP Storage Bucket Configuration Modification](/analytics-alerts/alerts-by-name/gcp-storage-bucket-configuration-modification.md)
* \[Informational] [GCP Storage Bucket Permissions Modification](/analytics-alerts/alerts-by-name/gcp-storage-bucket-permissions-modification.md)
* \[Informational] [GCP Storage Bucket deletion](/analytics-alerts/alerts-by-name/gcp-storage-bucket-deletion.md)
* \[Informational] [IAM Enumeration sequence](/analytics-alerts/alerts-by-name/iam-enumeration-sequence.md)
* \[Informational] [IAM instance profile was created](/analytics-alerts/alerts-by-name/iam-instance-profile-was-created.md)
* \[Informational] [IAM policy was attached to role](/analytics-alerts/alerts-by-name/iam-policy-was-attached-to-role.md)
* \[Informational] [Massive files deletion in Box](/analytics-alerts/alerts-by-name/massive-files-deletion-in-box.md)
* \[Informational] [Massive files deletion in Dropbox](/analytics-alerts/alerts-by-name/massive-files-deletion-in-dropbox.md)
* \[Informational] [Massive files deletion in Google Drive](/analytics-alerts/alerts-by-name/massive-files-deletion-in-google-drive.md)
* \[Informational] [Massive files deletion in Microsoft SharePoint or OneDrive](/analytics-alerts/alerts-by-name/massive-files-deletion-in-microsoft-sharepoint-or-onedrive.md)
* \[Informational] [Numerous emails sent by a single sender to multiple internal recipients](/analytics-alerts/alerts-by-name/numerous-emails-sent-by-a-single-sender-to-multiple-internal-recipients.md)
* \[Informational] [S3 configuration deletion](/analytics-alerts/alerts-by-name/s3-configuration-deletion.md)
* \[Informational] [Sender name used by multiple addresses across multiple domains](/analytics-alerts/alerts-by-name/sender-name-used-by-multiple-addresses-across-multiple-domains.md)
* \[Informational] [Sudden spike in outbound email volume](/analytics-alerts/alerts-by-name/sudden-spike-in-outbound-email-volume.md)
* \[Informational] [Suspicious sender exhibiting automated sending patterns](/analytics-alerts/alerts-by-name/suspicious-sender-exhibiting-automated-sending-patterns.md)
* \[Informational] [Suspicious sending domain with sender address randomization](/analytics-alerts/alerts-by-name/suspicious-sending-domain-with-sender-address-randomization.md)
* \[Informational] [Unusual IAM enumeration activity by a non-user Identity](/analytics-alerts/alerts-by-name/unusual-iam-enumeration-activity-by-a-non-user-identity.md)
* \[Informational] [Unusual attachment volume in outbound emails](/analytics-alerts/alerts-by-name/unusual-attachment-volume-in-outbound-emails.md)

### Modified Metadata

* \[Informational -> High] [Modification of PAM](/analytics-alerts/alerts-by-name/modification-of-pam.md)
  * \[Informational -> High] Modification of PAM from a Kubernetes pod - Modified Metadata
* \[Medium] [A mail forwarding rule was configured in Google Workspace](/analytics-alerts/alerts-by-name/a-mail-forwarding-rule-was-configured-in-google-workspace.md)
* \[Informational] [A Google Workspace identity used the security investigation tool](/analytics-alerts/alerts-by-name/a-google-workspace-identity-used-the-security-investigation-tool.md)
* \[Informational] [A Google Workspace service was configured as unrestricted](/analytics-alerts/alerts-by-name/a-google-workspace-service-was-configured-as-unrestricted.md)
* \[Informational] [A third-party application was authorized to access the Google Workspace APIs](/analytics-alerts/alerts-by-name/a-third-party-application-was-authorized-to-access-the-google-workspace-apis.md)
* \[Informational] [Chrome Extension Installed By User](/analytics-alerts/alerts-by-name/chrome-extension-installed-by-user.md)
* \[Informational] [Data Sharing between GCP and Google Workspace was disabled](/analytics-alerts/alerts-by-name/data-sharing-between-gcp-and-google-workspace-was-disabled.md)
* \[Informational] [Gmail delegation was turned on for the organization](/analytics-alerts/alerts-by-name/gmail-delegation-was-turned-on-for-the-organization.md)
* \[Informational] [Gmail routing settings changed](/analytics-alerts/alerts-by-name/gmail-routing-settings-changed.md)
* \[Informational] [Google Workspace automation was created](/analytics-alerts/alerts-by-name/google-workspace-automation-was-created.md)
* \[Informational] [Google Workspace user authentication information changed](/analytics-alerts/alerts-by-name/google-workspace-user-authentication-information-changed.md)
* \[Informational] [MFA was disabled for a Google Workspace user](/analytics-alerts/alerts-by-name/mfa-was-disabled-for-a-google-workspace-user.md)
* \[Informational] [Quarantined email released to recipients](/analytics-alerts/alerts-by-name/quarantined-email-released-to-recipients.md)
* \[Informational] [Security object deletion in Google Workspace Admin Console](/analytics-alerts/alerts-by-name/security-object-deletion-in-google-workspace-admin-console.md)
* \[Informational] [Suspicious OAuth application was authorized in Google Workspace](/analytics-alerts/alerts-by-name/suspicious-oauth-application-was-authorized-in-google-workspace.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-09-30.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.