GoAnywhere MFT File Shared With Changed Visibility

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects files transferred with a visibility or ownership change on the MFT platform. Widening who can retrieve a file is the quietest possible exfiltration route: the data never leaves the platform in a way the network would notice, it simply becomes reachable by someone new. Onboarding: GOANYWHERE-MFT is ingested via Syslog (Bloo extractor 850). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=documents where sourcename='GOANYWHERE-MFT' | groupby user, targetuser, file, filetype, visibility, owner