CyberArk Privileged Password Used From Unrecognised Source

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects use of a vaulted privileged credential from a source address with no prior history for that account. Privileged accounts operate from a narrow and stable set of jump hosts; a new origin means either an undocumented access path or an attacker operating the credential from their own foothold. Onboarding: CYBERARK is ingested via Syslog (CEF) (Bloo extractor 279). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=iam where sourcename='CYBERARK' and action='PASSWORD_USED' | groupby user, targetuser, srcip, role