Authentication Attempt Against Smokescreen Decoy Host
Detects any authentication attempt against a Smokescreen decoy asset. Decoys are not published in directories, hold no business function and are never referenced by legitimate automation, so an authentication attempt is attacker activity by definition rather than something requiring interpretation. This is the highest-signal, lowest-noise detection available on any log source: there is no benign path to a decoy login. Onboarding: SMOKESCREEN is ingested via Syslog (CEF) (Bloo extractor 206). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=authentication where sourcename='SMOKESCREEN' and action='LOGIN' | groupby user, srcip, authproto
Sigma
