GoAnywhere MFT Authentication From Unrecognised Source
Detects MFT authentication from a source address without prior history. Transfer platforms are reached by a small, stable set of partners and internal systems, so the population of legitimate source addresses is unusually predictable — which makes a new one unusually meaningful. Onboarding: GOANYWHERE-MFT is ingested via Syslog (Bloo extractor 850). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=authentication where sourcename='GOANYWHERE-MFT' and action='LOGIN' | duration 24h | groupby srcip, user, authproto
Sigma
