Siddhant Mishra
@SiddhantMumbaiCompletionist
0 followers0 downloads0 copies0 likes28 views
159 detections
Filters
Last updated
All Time
Detection languages
159
Categories
32
17
16
13
12
Platforms
34
29
25
16
1
Products / Services
26
8
5
5
5
MITRE Techniques
44
34
33
23
21
Detects an account joining the workspace. Slack Connect and guest access let outside
identities into an internal communication space, and an unexpected join is how an
attacker gains a listening position without touching the network perimeter at all.
Check the account type: a guest or external identity joining a channel carrying
operational or security discussion is worth immediate confirmation with the inviter.
Onboarding: SLACK is ingested via Slack native connector (Bloo extractor 833).
Integration guide: https://bloo.io/docs/integrations/slack
BQL (Bloo Query Language):
stream=iam where sourcename='SLACK' and action='USER_JOINED_WORKSPACE'
| groupby user, targetuser, accounttype, workspace
identities into an internal communication space, and an unexpected join is how an
attacker gains a listening position without touching the network perimeter at all.
Check the account type: a guest or external identity joining a channel carrying
operational or security discussion is worth immediate confirmation with the inviter.
Onboarding: SLACK is ingested via Slack native connector (Bloo extractor 833).
Integration guide: https://bloo.io/docs/integrations/slack
BQL (Bloo Query Language):
stream=iam where sourcename='SLACK' and action='USER_JOINED_WORKSPACE'
| groupby user, targetuser, accounttype, workspace
Detects a message having its recipient altered during processing. Recipient
rewriting redirects mail away from its intended reader, and is a quiet way to
intercept correspondence or to suppress a notification that would otherwise reveal
an ongoing compromise.
Onboarding: TREND-MICRO-DDEI is ingested via Syslog (CEF) (Bloo extractor 265).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=email-gateway where sourcename='TREND-MICRO-DDEI'
and action='EMAIL_RECIPIENT_CHANGED'
| groupby sender, recipient, direction, remoteip
rewriting redirects mail away from its intended reader, and is a quiet way to
intercept correspondence or to suppress a notification that would otherwise reveal
an ongoing compromise.
Onboarding: TREND-MICRO-DDEI is ingested via Syslog (CEF) (Bloo extractor 265).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=email-gateway where sourcename='TREND-MICRO-DDEI'
and action='EMAIL_RECIPIENT_CHANGED'
| groupby sender, recipient, direction, remoteip
Detects clusters of unreachable-service and no-connector-available events. Where
these concentrate on one application they suggest the connector serving it has been
disrupted — which, during an intrusion, denies access to the application while the
outage is treated as an infrastructure problem rather than a security one.
Onboarding: ZSCALER-SPA is ingested via the Zscaler connector (Bloo extractor 176).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=zpa-connector where sourcename='ZSCALER-SPA'
and action in ('SERVICE_NOT_REACHABLE', 'NO_CONNECTOR_AVAILABLE')
| duration 15m
| groupby app, reason
| select app, reason, count(*) as cnt
| having cnt > 15
these concentrate on one application they suggest the connector serving it has been
disrupted — which, during an intrusion, denies access to the application while the
outage is treated as an infrastructure problem rather than a security one.
Onboarding: ZSCALER-SPA is ingested via the Zscaler connector (Bloo extractor 176).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=zpa-connector where sourcename='ZSCALER-SPA'
and action in ('SERVICE_NOT_REACHABLE', 'NO_CONNECTOR_AVAILABLE')
| duration 15m
| groupby app, reason
| select app, reason, count(*) as cnt
| having cnt > 15
Detects access to directory service objects. Bulk reads of directory objects are how
an attacker maps the domain — users, groups, trusts, service principals — before
deciding what to target. It is read-only activity, which means nothing breaks and
nothing else is likely to alert.
Onboarding: MANAGE-ENGINE-ADAUDIT-PLUS is ingested via Syslog (KV) (Bloo extractor 830).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=win-audit where sourcename='MANAGE-ENGINE-ADAUDIT-PLUS'
and action='DIRECTORY_SERVICE_ACCESSED'
| duration 1h
| groupby user, objectclass, objecttype, domain
an attacker maps the domain — users, groups, trusts, service principals — before
deciding what to target. It is read-only activity, which means nothing breaks and
nothing else is likely to alert.
Onboarding: MANAGE-ENGINE-ADAUDIT-PLUS is ingested via Syslog (KV) (Bloo extractor 830).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=win-audit where sourcename='MANAGE-ENGINE-ADAUDIT-PLUS'
and action='DIRECTORY_SERVICE_ACCESSED'
| duration 1h
| groupby user, objectclass, objecttype, domain
Detects algorithmically generated domain names at the resolver. Malware families
using a DGA cycle through many candidate domains to find their live controller, so
the resolver sees a burst of long, random-looking names, most of which fail to
resolve.
Resolver-level visibility covers every device that uses the resolver, including
those with no endpoint agent — appliances, IoT and unmanaged hosts.
Onboarding: INFOBLOX is ingested via Syslog (CEF) (Bloo extractor 155).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dns where sourcename='INFOBLOX' and action='DNS_QUERIED'
and len(query) > 30
| groupby srcip, query, recordtype, responsecode
using a DGA cycle through many candidate domains to find their live controller, so
the resolver sees a burst of long, random-looking names, most of which fail to
resolve.
Resolver-level visibility covers every device that uses the resolver, including
those with no endpoint agent — appliances, IoT and unmanaged hosts.
Onboarding: INFOBLOX is ingested via Syslog (CEF) (Bloo extractor 155).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dns where sourcename='INFOBLOX' and action='DNS_QUERIED'
and len(query) > 30
| groupby srcip, query, recordtype, responsecode
Detects use of a credential seeded by the deception platform. Decoy credentials are
planted where an intruder will find them — in memory, in config files, in browser
stores — and are never issued to a person, so any use proves both that credential
theft occurred and that the attacker has begun using what they stole.
The source address on the use tells you where the attacker is operating from, which
is usually a host you did not yet know was involved.
Onboarding: SMOKESCREEN is ingested via Syslog (CEF) (Bloo extractor 206).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='SMOKESCREEN' and action='THREAT_DETECTED'
and user != ''
| groupby user, srcip, dstip, threat
planted where an intruder will find them — in memory, in config files, in browser
stores — and are never issued to a person, so any use proves both that credential
theft occurred and that the attacker has begun using what they stole.
The source address on the use tells you where the attacker is operating from, which
is usually a host you did not yet know was involved.
Onboarding: SMOKESCREEN is ingested via Syslog (CEF) (Bloo extractor 206).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='SMOKESCREEN' and action='THREAT_DETECTED'
and user != ''
| groupby user, srcip, dstip, threat
Detects one account retrieving an unusually high number of distinct privileged
credentials in a short window. Legitimate privileged work involves one or two
checkouts for a specific task; sweeping the vault is what an attacker does after
compromising a PAM operator account, to harvest as much as possible before the
access is noticed.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='PAM360' and action='PASSWORD_RETRIEVED'
| duration 1h
| groupby user
| select user, distinct_count(targetuser)
| having distinct_count_col1 > 10
credentials in a short window. Legitimate privileged work involves one or two
checkouts for a specific task; sweeping the vault is what an attacker does after
compromising a PAM operator account, to harvest as much as possible before the
access is noticed.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='PAM360' and action='PASSWORD_RETRIEVED'
| duration 1h
| groupby user
| select user, distinct_count(targetuser)
| having distinct_count_col1 > 10
Detects a CyberArk threat event carrying command-line content from a privileged
session. The platform flags the session as suspicious and simultaneously records what
was typed, which gives an unusually direct view of attacker behaviour inside a
privileged context.
Review the command line in full before judging severity; PAM sessions legitimately
carry administrative commands that look alarming out of context.
Onboarding: CYBERARK is ingested via Syslog (CEF) (Bloo extractor 279).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='CYBERARK' and action='THREAT_DETECTED'
and commandline != ''
| groupby user, targetuser, commandline, process, srcip
session. The platform flags the session as suspicious and simultaneously records what
was typed, which gives an unusually direct view of attacker behaviour inside a
privileged context.
Review the command line in full before judging severity; PAM sessions legitimately
carry administrative commands that look alarming out of context.
Onboarding: CYBERARK is ingested via Syslog (CEF) (Bloo extractor 279).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='CYBERARK' and action='THREAT_DETECTED'
and commandline != ''
| groupby user, targetuser, commandline, process, srcip
Detects account creation on the NAS. Storage appliances are often administered
outside central identity management, so a local account created on one is both
durable persistence and largely invisible to directory-based monitoring.
An account created here survives domain-level remediation entirely.
Onboarding: DISKSTATION-NAS is ingested via Syslog (Bloo extractor 826).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='DISKSTATION-NAS' and action='USER_CREATED'
| groupby user, targetuser, role, srcip
outside central identity management, so a local account created on one is both
durable persistence and largely invisible to directory-based monitoring.
An account created here survives domain-level remediation entirely.
Onboarding: DISKSTATION-NAS is ingested via Syslog (Bloo extractor 826).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='DISKSTATION-NAS' and action='USER_CREATED'
| groupby user, targetuser, role, srcip
Detects one subject line delivered to an unusually wide internal recipient set. This
is the shape of internal phishing from a compromised mailbox, which is far more
effective than external phishing because it arrives from a trusted colleague and
passes authentication checks.
Onboarding: MS-EXCHANGE is ingested via Syslog (Bloo extractor 142).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=email-gateway where sourcename='MS-EXCHANGE' and action='EMAIL_DELIVERED'
| duration 1h
| groupby subject, sender
| select subject, sender, distinct_count(recipient)
| having distinct_count_col1 > 25
is the shape of internal phishing from a compromised mailbox, which is far more
effective than external phishing because it arrives from a trusted colleague and
passes authentication checks.
Onboarding: MS-EXCHANGE is ingested via Syslog (Bloo extractor 142).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=email-gateway where sourcename='MS-EXCHANGE' and action='EMAIL_DELIVERED'
| duration 1h
| groupby subject, sender
| select subject, sender, distinct_count(recipient)
| having distinct_count_col1 > 25
Page 11 of 16