Synology NAS Bulk File Access From Unrecognised Source

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects extensive file access on the NAS from a source address without prior history. Shared storage holds concentrated value, and bulk reads from an unfamiliar origin is the reconnaissance-then-collection pattern applied to a file share. Onboarding: DISKSTATION-NAS is ingested via Syslog (Bloo extractor 826). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=documents where sourcename='DISKSTATION-NAS' and action='ACCESSED' | duration 1h | groupby srcip, user | select srcip, user, distinct_count(file) | having distinct_count_col1 > 100