PAM360 Vault Configuration Changed by Non-Administrator
Detects configuration changes to the PAM platform itself. Vault configuration governs who may retrieve which credentials and what is recorded; altering it is how an attacker grants themselves durable privileged access while suppressing the evidence of having done so. Changes made by an account that does not normally administer the vault are the ones worth escalating. Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=configuration where sourcename='PAM360' and action='CONFIGURATION_CHANGED' | groupby user, config, srcip, role
Sigma
