Outbound Connection Initiated From Smokescreen Decoy
Detects a decoy asset initiating an outbound connection. A decoy should only ever receive traffic. Outbound activity means the asset has been compromised and is being used as a launch point, or that attacker tooling on it is calling home. The destination is live command-and-control infrastructure and should be blocked estate-wide immediately rather than only on the decoy. Onboarding: SMOKESCREEN is ingested via Syslog (CEF) (Bloo extractor 206). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=threat where sourcename='SMOKESCREEN' and action='THREAT_DETECTED' and dstip != '' | groupby dstip, url, process, srcip
Sigma
