CyberArk Privileged Account Used Outside Its Normal Host Set

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects a privileged account authenticating to destinations outside its established pattern. Privileged accounts are usually scoped to a defined estate — a database admin reaches databases, not workstations. Appearance outside that scope is lateral movement using legitimate credentials, which endpoint tooling will not flag. Onboarding: CYBERARK is ingested via Syslog (CEF) (Bloo extractor 279). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=authentication where sourcename='CYBERARK' and action='LOGIN' | groupby user, dstip, srcip, authproto