Siddhant Mishra
@SiddhantMumbaiCompletionist
0 followers0 downloads0 copies0 likes28 views
159 detections
Filters
Last updated
All Time
Detection languages
159
Categories
32
17
16
13
12
Platforms
34
29
25
16
1
Products / Services
26
8
5
5
5
MITRE Techniques
44
34
33
23
21
Detects an endpoint or identity moving from a guest role to a corporate one. Guest
networks are deliberately segregated; a transition to corporate access means either
a legitimate onboarding or an attacker who entered through the least-controlled door
and found a way inward.
Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CISCO-ISE' and action='PASSWORD_CHANGED'
| groupby user, targetuser, role, srcip
networks are deliberately segregated; a transition to corporate access means either
a legitimate onboarding or an attacker who entered through the least-controlled door
and found a way inward.
Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CISCO-ISE' and action='PASSWORD_CHANGED'
| groupby user, targetuser, role, srcip
Detects a successful network admission following repeated posture compliance
failures for the same endpoint. The expected outcome of failing posture is
remediation then access; failures followed by success without remediation suggests
the check was bypassed, disabled, or satisfied by spoofed posture data.
Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=compliance where sourcename='CISCO-ISE' and action='COMPLIANCE_CHECK'
| duration 1h
| groupby user, policy, reason, srcip
failures for the same endpoint. The expected outcome of failing posture is
remediation then access; failures followed by success without remediation suggests
the check was bypassed, disabled, or satisfied by spoofed posture data.
Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=compliance where sourcename='CISCO-ISE' and action='COMPLIANCE_CHECK'
| duration 1h
| groupby user, policy, reason, srcip
Detects mail being redirected to an external recipient. Redirection rules are the
classic persistence mechanism on a compromised mailbox: they survive password resets,
require no further access, and quietly copy correspondence to the attacker for as
long as they remain in place.
This is among the most under-monitored controls in most estates, because the rule is
set once and never fires an alert again.
Onboarding: MS-EXCHANGE is ingested via Syslog (Bloo extractor 142).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=email-gateway where sourcename='MS-EXCHANGE'
and action='EMAIL_REDIRECTED'
| groupby sender, recipient, direction, remoteip
classic persistence mechanism on a compromised mailbox: they survive password resets,
require no further access, and quietly copy correspondence to the attacker for as
long as they remain in place.
This is among the most under-monitored controls in most estates, because the rule is
set once and never fires an alert again.
Onboarding: MS-EXCHANGE is ingested via Syslog (Bloo extractor 142).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=email-gateway where sourcename='MS-EXCHANGE'
and action='EMAIL_REDIRECTED'
| groupby sender, recipient, direction, remoteip
Detects modification of ISE configuration governing who may join the network and
under what conditions. A policy change is the most efficient way to grant durable
unauthorised access: rather than defeating the control repeatedly, the attacker
rewrites it once.
Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='CISCO-ISE'
and action='CONFIGURATION_CHANGED'
| groupby user, config, srcip, policy
under what conditions. A policy change is the most efficient way to grant durable
unauthorised access: rather than defeating the control repeatedly, the attacker
rewrites it once.
Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='CISCO-ISE'
and action='CONFIGURATION_CHANGED'
| groupby user, config, srcip, policy
Detects one endpoint authenticating under several distinct user identities in a short
period. A workstation normally carries one user at a time. Several identities from
one endpoint suggests credential testing, a shared or kiosk device being misused, or
an attacker working through harvested accounts from a single foothold.
Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='CISCO-ISE' and action='LOGIN'
| duration 1h
| groupby srcip
| select srcip, distinct_count(user)
| having distinct_count_col1 > 4
period. A workstation normally carries one user at a time. Several identities from
one endpoint suggests credential testing, a shared or kiosk device being misused, or
an attacker working through harvested accounts from a single foothold.
Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='CISCO-ISE' and action='LOGIN'
| duration 1h
| groupby srcip
| select srcip, distinct_count(user)
| having distinct_count_col1 > 4
Detects an unusual volume of externally directed mail from one sender. Mail is a
high-capacity exfiltration channel that is permitted by default, and a compromised
mailbox sending outward in bulk is both data loss and, where the content is phishing,
damage to the organisation's sending reputation.
Onboarding: MS-EXCHANGE is ingested via Syslog (Bloo extractor 142).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=email-gateway where sourcename='MS-EXCHANGE'
and action='EMAIL_SENT_EXTERNAL'
| duration 1h
| groupby sender
| select sender, count(*) as cnt
| having cnt > 100
high-capacity exfiltration channel that is permitted by default, and a compromised
mailbox sending outward in bulk is both data loss and, where the content is phishing,
damage to the organisation's sending reputation.
Onboarding: MS-EXCHANGE is ingested via Syslog (Bloo extractor 142).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=email-gateway where sourcename='MS-EXCHANGE'
and action='EMAIL_SENT_EXTERNAL'
| duration 1h
| groupby sender
| select sender, count(*) as cnt
| having cnt > 100
Detects a pattern of lease denials consistent with DHCP starvation, where an attacker
requests leases until the pool is empty so that legitimate devices cannot obtain an
address. It is typically a precursor to a rogue DHCP server taking over address
assignment and redirecting traffic.
Onboarding: WIN-DHCP is ingested via Syslog (Bloo extractor 79).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dhcp where sourcename='WIN-DHCP' and action='IP_LEASE_DENIED'
| duration 10m
| groupby macaddress
| select macaddress, count(*) as cnt
| having cnt > 20
requests leases until the pool is empty so that legitimate devices cannot obtain an
address. It is typically a precursor to a rogue DHCP server taking over address
assignment and redirecting traffic.
Onboarding: WIN-DHCP is ingested via Syslog (Bloo extractor 79).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dhcp where sourcename='WIN-DHCP' and action='IP_LEASE_DENIED'
| duration 10m
| groupby macaddress
| select macaddress, count(*) as cnt
| having cnt > 20
Detects DNS tunnelling, where data is encoded into queries and answers against a
domain the attacker controls. TXT records carry the most payload per query, so a
high volume of TXT lookups beneath one parent domain is the characteristic shape.
Tunnelling is slow, which means it is usually evidence of a long-running compromise
rather than a recent one.
Onboarding: INFOBLOX is ingested via Syslog (CEF) (Bloo extractor 155).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dns where sourcename='INFOBLOX' and action='DNS_QUERIED'
and lower(recordtype) = 'txt'
| duration 1h
| groupby srcip
| select srcip, count(*) as cnt
| having cnt > 100
domain the attacker controls. TXT records carry the most payload per query, so a
high volume of TXT lookups beneath one parent domain is the characteristic shape.
Tunnelling is slow, which means it is usually evidence of a long-running compromise
rather than a recent one.
Onboarding: INFOBLOX is ingested via Syslog (CEF) (Bloo extractor 155).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dns where sourcename='INFOBLOX' and action='DNS_QUERIED'
and lower(recordtype) = 'txt'
| duration 1h
| groupby srcip
| select srcip, count(*) as cnt
| having cnt > 100
Detects extensive file access on the NAS from a source address without prior
history. Shared storage holds concentrated value, and bulk reads from an unfamiliar
origin is the reconnaissance-then-collection pattern applied to a file share.
Onboarding: DISKSTATION-NAS is ingested via Syslog (Bloo extractor 826).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=documents where sourcename='DISKSTATION-NAS' and action='ACCESSED'
| duration 1h
| groupby srcip, user
| select srcip, user, distinct_count(file)
| having distinct_count_col1 > 100
history. Shared storage holds concentrated value, and bulk reads from an unfamiliar
origin is the reconnaissance-then-collection pattern applied to a file share.
Onboarding: DISKSTATION-NAS is ingested via Syslog (Bloo extractor 826).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=documents where sourcename='DISKSTATION-NAS' and action='ACCESSED'
| duration 1h
| groupby srcip, user
| select srcip, user, distinct_count(file)
| having distinct_count_col1 > 100
Detects retrieval of a privileged credential from the PAM360 vault outside normal
working hours. Credential checkout is the moment privileged access actually begins,
and an out-of-hours retrieval with no corresponding change ticket is the earliest
reliable indicator of vault misuse.
Tune the window to the customer's working pattern before deployment; a global estate
will need per-region hours rather than a single range.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='PAM360' and action='PASSWORD_RETRIEVED'
| groupby user, targetuser, srcip, role
working hours. Credential checkout is the moment privileged access actually begins,
and an out-of-hours retrieval with no corresponding change ticket is the earliest
reliable indicator of vault misuse.
Tune the window to the customer's working pattern before deployment; a global estate
will need per-region hours rather than a single range.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='PAM360' and action='PASSWORD_RETRIEVED'
| groupby user, targetuser, srcip, role
Page 12 of 16