Process Execution Observed on Smokescreen Decoy Asset

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects process execution reported by a Smokescreen decoy. A decoy runs no business workload, so any process beyond the platform's own agent indicates an intruder has reached the asset and is executing code on it. Capture the command line in full: on a decoy it is uncontaminated by legitimate activity and gives a clean view of attacker tooling and intent. Onboarding: SMOKESCREEN is ingested via Syslog (CEF) (Bloo extractor 206). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=threat where sourcename='SMOKESCREEN' and action='THREAT_DETECTED' and process != '' | groupby process, commandline, user, srcip