CyberArk Privileged Password Changed Following Failed Logins

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects a privileged password change shortly after failed authentication attempts against the vault. An attacker who gains vault access frequently rotates the credential to lock out the legitimate owner and secure their own hold on it. The sequence matters more than either event alone: failures followed by a successful change is the pattern, and a change on its own is routine. Onboarding: CYBERARK is ingested via Syslog (CEF) (Bloo extractor 279). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=iam where sourcename='CYBERARK' and action='PASSWORD_CHANGED' | groupby user, targetuser, srcip, reason