ARCOS Authentication Protocol Downgrade on Privileged Database Access

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects a change in authentication protocol for privileged database access brokered by ARCOS. A downgrade to a weaker protocol for an account that previously used a stronger one suggests either a misconfiguration that weakens the estate or an attacker steering authentication toward a method they can intercept or replay. Baseline the protocol per account before deployment; some legacy database clients genuinely only support older methods. Onboarding: ARCOS-DBEVT is ingested via RDBMS Log Shipper (Bloo extractor 225). Integration guide: https://bloo.io/docs/integrations BQL (Bloo Query Language): stream=authentication where sourcename='ARCOS-DBEVT' and action='LOGIN' | groupby authproto, user, srcip