GoAnywhere MFT Login Without MFA Initiation
Detects authentication to the MFT platform where multi-factor was not initiated. The extractor records MFA_INITIATED separately from LOGIN, so a login with no corresponding MFA event indicates either an account exempt from the policy or a path around it — on an internet-facing transfer platform, both matter. Onboarding: GOANYWHERE-MFT is ingested via Syslog (Bloo extractor 850). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=authentication where sourcename='GOANYWHERE-MFT' and action='LOGIN' | groupby user, srcip, authproto
Sigma
