PAM360 Credential Retrieved But Never Used
Detects a privileged credential retrieved from the vault with no session following it. Legitimate checkout is followed by work. Retrieval without use suggests the credential was taken to be kept — staged for later, or exfiltrated for use outside the platform where the vault cannot see it. This is a slow-burn detection and deliberately so: it surfaces preparation rather than action, which is where the response window is widest. Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=iam where sourcename='PAM360' and action='PASSWORD_RETRIEVED' | duration 24h | groupby user, targetuser
Sigma
