Thycotic Secret Server Password Displayed on Screen
Detects a secret being revealed in the Secret Server interface. Launching a session uses a credential without exposing it; displaying it puts the plaintext in front of a human, where it can be copied, photographed or written down and used outside every control the vault provides. Display is materially more serious than use, and the two are worth separating. Onboarding: SECRET-SERVER is ingested via Syslog (CEF) (Bloo extractor 844). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=secretserver-secret where sourcename='SECRET-SERVER' and action='PASSWORD_DISPLAYED' | groupby user, file, filetype, srcip
Sigma
