PAM360 Bulk Credential Retrieval by Single User
Detects one account retrieving an unusually high number of distinct privileged credentials in a short window. Legitimate privileged work involves one or two checkouts for a specific task; sweeping the vault is what an attacker does after compromising a PAM operator account, to harvest as much as possible before the access is noticed. Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=iam where sourcename='PAM360' and action='PASSWORD_RETRIEVED' | duration 1h | groupby user | select user, distinct_count(targetuser) | having distinct_count_col1 > 10
Sigma
