File Access on Smokescreen Decoy Share
Detects access to files hosted on a decoy share. Decoy shares carry inviting names and plausible content but hold nothing real and are linked from nowhere, so a file open is deliberate discovery rather than a user stumbling into the wrong folder. Which file was opened is itself intelligence: it indicates what the intruder is looking for, and that shapes where you look next in the real estate. Onboarding: SMOKESCREEN is ingested via Syslog (CEF) (Bloo extractor 206). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=threat where sourcename='SMOKESCREEN' and action='THREAT_DETECTED' and file != '' | groupby file, user, srcip
Sigma
