Smokescreen Decoy Credential Used Elsewhere in the Estate
Detects use of a credential seeded by the deception platform. Decoy credentials are planted where an intruder will find them — in memory, in config files, in browser stores — and are never issued to a person, so any use proves both that credential theft occurred and that the attacker has begun using what they stole. The source address on the use tells you where the attacker is operating from, which is usually a host you did not yet know was involved. Onboarding: SMOKESCREEN is ingested via Syslog (CEF) (Bloo extractor 206). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=threat where sourcename='SMOKESCREEN' and action='THREAT_DETECTED' and user != '' | groupby user, srcip, dstip, threat
Sigma
