Siddhant Mishra
@SiddhantMumbaiCompletionist
0 followers0 downloads0 copies0 likes28 views
159 detections
Filters
Last updated
All Time
Detection languages
159
Categories
32
17
16
13
12
Platforms
34
29
25
16
1
Products / Services
26
8
5
5
5
MITRE Techniques
44
34
33
23
21
Detects heartbeat and synchronisation events in Secret Server. Heartbeat verifies a
stored credential still works on the target. Repeated failures mean the credential
has changed outside the vault — which happens when an attacker rotates it to lock the
organisation out of its own privileged account.
Onboarding: SECRET-SERVER is ingested via Syslog (CEF) (Bloo extractor 844).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=secretserver-secret where sourcename='SECRET-SERVER'
and action in ('HEARTBEAT', 'SYNCHRONIZED')
| duration 1h
| groupby user, file, filetype
stored credential still works on the target. Repeated failures mean the credential
has changed outside the vault — which happens when an attacker rotates it to lock the
organisation out of its own privileged account.
Onboarding: SECRET-SERVER is ingested via Syslog (CEF) (Bloo extractor 844).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=secretserver-secret where sourcename='SECRET-SERVER'
and action in ('HEARTBEAT', 'SYNCHRONIZED')
| duration 1h
| groupby user, file, filetype
Detects an account being unlocked through Centrify on Windows. Lockout is often the
only visible consequence of a password-guessing attempt; an unlock immediately
afterwards either restores a locked-out colleague or, if performed by the attacker
who caused it, clears the obstacle so guessing can continue.
Onboarding: CENTRIFY-AUDITTRAIL-WINDOWS is ingested via Syslog (KV) (Bloo extractor 821).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CENTRIFY-AUDITTRAIL-WINDOWS' and action='USER_UNLOCKED'
| groupby user, targetuser, domain, role
only visible consequence of a password-guessing attempt; an unlock immediately
afterwards either restores a locked-out colleague or, if performed by the attacker
who caused it, clears the obstacle so guessing can continue.
Onboarding: CENTRIFY-AUDITTRAIL-WINDOWS is ingested via Syslog (KV) (Bloo extractor 821).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CENTRIFY-AUDITTRAIL-WINDOWS' and action='USER_UNLOCKED'
| groupby user, targetuser, domain, role
Detects scheduled task creation observed through ADAudit Plus. Scheduled tasks are a
long-standing persistence and remote execution mechanism, and seeing them at the
directory audit layer catches creation across the domain rather than host by host.
Onboarding: MANAGE-ENGINE-ADAUDIT-PLUS is ingested via Syslog (KV) (Bloo extractor 830).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=win-audit where sourcename='MANAGE-ENGINE-ADAUDIT-PLUS'
and action='TASK_CREATED'
| groupby user, object, commandline, domain
long-standing persistence and remote execution mechanism, and seeing them at the
directory audit layer catches creation across the domain rather than host by host.
Onboarding: MANAGE-ENGINE-ADAUDIT-PLUS is ingested via Syslog (KV) (Bloo extractor 830).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=win-audit where sourcename='MANAGE-ENGINE-ADAUDIT-PLUS'
and action='TASK_CREATED'
| groupby user, object, commandline, domain
Detects one account viewing many secrets in a short period. Normal privileged work
touches one or two; sweeping the vault is harvesting, and it is the single most
valuable action available to an attacker who reaches a PAM platform.
Onboarding: SECRET-SERVER is ingested via Syslog (CEF) (Bloo extractor 844).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=secretserver-secret where sourcename='SECRET-SERVER' and action='VIEWED'
| duration 1h
| groupby user, srcip
| select user, srcip, distinct_count(file)
| having distinct_count_col1 > 10
touches one or two; sweeping the vault is harvesting, and it is the single most
valuable action available to an attacker who reaches a PAM platform.
Onboarding: SECRET-SERVER is ingested via Syslog (CEF) (Bloo extractor 844).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=secretserver-secret where sourcename='SECRET-SERVER' and action='VIEWED'
| duration 1h
| groupby user, srcip
| select user, srcip, distinct_count(file)
| having distinct_count_col1 > 10
Detects export of the Atlassian audit log. An export hands over the full record of
who did what across the tenant, which is reconnaissance of the administrative
landscape and, in the wrong hands, a map of which accounts are worth targeting.
Rare enough in normal operation that each occurrence can be confirmed individually.
Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832).
Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ATLASSIAN' and action='AUDIT_LOG_EXPORTED'
| groupby user, sitename, domain
who did what across the tenant, which is reconnaissance of the administrative
landscape and, in the wrong hands, a map of which accounts are worth targeting.
Rare enough in normal operation that each occurrence can be confirmed individually.
Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832).
Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ATLASSIAN' and action='AUDIT_LOG_EXPORTED'
| groupby user, sitename, domain
Detects deletion of a Jira issue security scheme. These schemes restrict who can see
sensitive issues — security findings, HR matters, incident records. Removing one can
expose restricted issues to the whole project at a stroke, and it is a quiet way to
gain access to material that was deliberately walled off.
Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832).
Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector
BQL (Bloo Query Language):
stream=jira-project where sourcename='ATLASSIAN'
and action='SECURITY_SCHEME_DELETED'
| groupby user, project, issuesecurityscheme, permissionscheme
sensitive issues — security findings, HR matters, incident records. Removing one can
expose restricted issues to the whole project at a stroke, and it is a quiet way to
gain access to material that was deliberately walled off.
Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832).
Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector
BQL (Bloo Query Language):
stream=jira-project where sourcename='ATLASSIAN'
and action='SECURITY_SCHEME_DELETED'
| groupby user, project, issuesecurityscheme, permissionscheme
Detects repositories being downloaded. Source code is intellectual property and
frequently contains embedded secrets, infrastructure detail and the logic of the
security controls themselves. Bulk download by one actor is the clearest signal of
code theft, whether by a departing engineer or a compromised account.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=github where sourcename='GITHUB' and action='REPOSITORY_DOWNLOADED'
| duration 1h
| groupby target
| select target, distinct_count(repositoryid)
| having distinct_count_col1 > 5
frequently contains embedded secrets, infrastructure detail and the logic of the
security controls themselves. Bulk download by one actor is the clearest signal of
code theft, whether by a departing engineer or a compromised account.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=github where sourcename='GITHUB' and action='REPOSITORY_DOWNLOADED'
| duration 1h
| groupby target
| select target, distinct_count(repositoryid)
| having distinct_count_col1 > 5
Detects a large outbound transfer measured at the Versa edge. Branch sites typically
send modest volumes, so a sustained upload from one is either a backup nobody
documented or data leaving a location with the least security coverage in the
estate.
Onboarding: VERSA-NETWORKS is ingested via Syslog (KV) (Bloo extractor 806).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=firewall where sourcename='VERSA-NETWORKS'
and action='SESSION_ESTABLISHED'
| duration 1h
| groupby srcip, dstip, dstport, app, txlen
send modest volumes, so a sustained upload from one is either a backup nobody
documented or data leaving a location with the least security coverage in the
estate.
Onboarding: VERSA-NETWORKS is ingested via Syslog (KV) (Bloo extractor 806).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=firewall where sourcename='VERSA-NETWORKS'
and action='SESSION_ESTABLISHED'
| duration 1h
| groupby srcip, dstip, dstport, app, txlen
Detects configuration changes on the email inspector. Weakening sandbox analysis —
reducing detonation scope, excluding file types, disabling URL inspection — opens a
delivery path for everyone the gateway protects, and the change itself is the only
evidence until something gets through.
Onboarding: TREND-MICRO-DDEI is ingested via Syslog (CEF) (Bloo extractor 265).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='TREND-MICRO-DDEI'
and action='CONFIGURATION_CHANGED'
| groupby user, config
reducing detonation scope, excluding file types, disabling URL inspection — opens a
delivery path for everyone the gateway protects, and the change itself is the only
evidence until something gets through.
Onboarding: TREND-MICRO-DDEI is ingested via Syslog (CEF) (Bloo extractor 265).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='TREND-MICRO-DDEI'
and action='CONFIGURATION_CHANGED'
| groupby user, config
Detects modification of user account attributes in Active Directory. Attribute
changes are how durable access is engineered quietly: disabling pre-authentication,
setting a service principal name, or clearing password expiry each weaken an account
without creating a new one for anybody to notice.
Onboarding: MANAGE-ENGINE-ADAUDIT-PLUS is ingested via Syslog (KV) (Bloo extractor 830).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='MANAGE-ENGINE-ADAUDIT-PLUS'
and action='USER_ACCOUNT_CHANGED'
| groupby user, targetuser, accountdomain, category, role
changes are how durable access is engineered quietly: disabling pre-authentication,
setting a service principal name, or clearing password expiry each weaken an account
without creating a new one for anybody to notice.
Onboarding: MANAGE-ENGINE-ADAUDIT-PLUS is ingested via Syslog (KV) (Bloo extractor 830).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='MANAGE-ENGINE-ADAUDIT-PLUS'
and action='USER_ACCOUNT_CHANGED'
| groupby user, targetuser, accountdomain, category, role
Page 10 of 16