Thycotic Secret Server Bulk Secret Viewing
Detects one account viewing many secrets in a short period. Normal privileged work touches one or two; sweeping the vault is harvesting, and it is the single most valuable action available to an attacker who reaches a PAM platform. Onboarding: SECRET-SERVER is ingested via Syslog (CEF) (Bloo extractor 844). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=secretserver-secret where sourcename='SECRET-SERVER' and action='VIEWED' | duration 1h | groupby user, srcip | select user, srcip, distinct_count(file) | having distinct_count_col1 > 10
Sigma
