Synology NAS Mass File Deletion by Single Account
Detects a single account deleting a large number of files on the NAS. On shared storage this is either ransomware working through the share, a destructive insider, or an attacker removing backups before encrypting the primary estate. NAS appliances rarely carry endpoint agents, so their own logs are frequently the only place this is visible. Onboarding: DISKSTATION-NAS is ingested via Syslog (Bloo extractor 826). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=documents where sourcename='DISKSTATION-NAS' and action='DELETED' | duration 10m | groupby user, srcip | select user, srcip, count(*) as cnt | having cnt > 50
Sigma
