Centrify Windows Privileged Command Executed

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects a privileged command executed through Centrify on Windows. Brokered elevation records the command under the identity that requested it rather than the shared administrative account it ran as, which restores attribution that local Windows auditing frequently loses. Onboarding: CENTRIFY-AUDITTRAIL-WINDOWS is ingested via Syslog (KV) (Bloo extractor 821). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=iam where sourcename='CENTRIFY-AUDITTRAIL-WINDOWS' and action='USER_COMMAND_EXECUTED' | groupby user, targetuser, role, domain