GoAnywhere MFT Bulk File Download by Single Account

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects one account downloading many files through GoAnywhere Managed File Transfer. MFT platforms sit between organisations and hold exactly the data worth stealing — payment files, payroll, partner exchanges — and have been the target of mass exploitation campaigns precisely because they are internet-facing and rarely watched. Onboarding: GOANYWHERE-MFT is ingested via Syslog (Bloo extractor 850). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=documents where sourcename='GOANYWHERE-MFT' and action='DOWNLOADED' | duration 1h | groupby user, srcip | select user, srcip, distinct_count(file) | having distinct_count_col1 > 20