Synology NAS Administrative Account Created

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects account creation on the NAS. Storage appliances are often administered outside central identity management, so a local account created on one is both durable persistence and largely invisible to directory-based monitoring. An account created here survives domain-level remediation entirely. Onboarding: DISKSTATION-NAS is ingested via Syslog (Bloo extractor 826). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=iam where sourcename='DISKSTATION-NAS' and action='USER_CREATED' | groupby user, targetuser, role, srcip