Siddhant Mishra
@SiddhantMumbaiCompletionist
0 followers0 downloads0 copies0 likes28 views
159 detections
Filters
Last updated
All Time
Detection languages
159
Categories
32
17
16
13
12
Platforms
34
29
25
16
1
Products / Services
26
8
5
5
5
MITRE Techniques
44
34
33
23
21
Detects a role being added in Centrify for Linux. Roles determine which servers an
identity can reach and what it may do there, so adding one is a durable grant of
access to Unix infrastructure that frequently sits outside the scope of Windows
centric monitoring.
Onboarding: CENTRIFY-AUDITTRAIL-LINUX is ingested via Syslog (KV) (Bloo extractor 822).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CENTRIFY-AUDITTRAIL-LINUX' and action='ROLE_ADDED'
| groupby user, targetuser, role, group, domain
identity can reach and what it may do there, so adding one is a durable grant of
access to Unix infrastructure that frequently sits outside the scope of Windows
centric monitoring.
Onboarding: CENTRIFY-AUDITTRAIL-LINUX is ingested via Syslog (KV) (Bloo extractor 822).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CENTRIFY-AUDITTRAIL-LINUX' and action='ROLE_ADDED'
| groupby user, targetuser, role, group, domain
Detects clients reaching for ports that are unreachable or not permitted. A client
repeatedly attempting wrong ports against brokered applications is enumerating what
the broker will allow, which is reconnaissance conducted entirely inside an
authenticated zero trust session.
Onboarding: ZSCALER-SPA is ingested via the Zscaler connector (Bloo extractor 176).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=zpa-connector where sourcename='ZSCALER-SPA'
and action in ('CLIENT_WRONG_PORT', 'PORT_UNREACHABLE')
| duration 1h
| groupby user, srcip
| select user, srcip, distinct_count(dstport)
| having distinct_count_col1 > 10
repeatedly attempting wrong ports against brokered applications is enumerating what
the broker will allow, which is reconnaissance conducted entirely inside an
authenticated zero trust session.
Onboarding: ZSCALER-SPA is ingested via the Zscaler connector (Bloo extractor 176).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=zpa-connector where sourcename='ZSCALER-SPA'
and action in ('CLIENT_WRONG_PORT', 'PORT_UNREACHABLE')
| duration 1h
| groupby user, srcip
| select user, srcip, distinct_count(dstport)
| having distinct_count_col1 > 10
Detects repeated network policy access denials. NPS governs RADIUS-based access to
VPN and wireless, so a burst of denials for one identity is credential testing
against the remote access perimeter — often the first move against an organisation
from outside.
Onboarding: MANAGE-ENGINE-ADAUDIT-PLUS is ingested via Syslog (KV) (Bloo extractor 830).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=win-audit where sourcename='MANAGE-ENGINE-ADAUDIT-PLUS'
and action='NPS_USER_DENIED'
| duration 15m
| groupby user, networkpolicyname, reasoncode
| select user, networkpolicyname, reasoncode, count(*) as cnt
| having cnt > 10
VPN and wireless, so a burst of denials for one identity is credential testing
against the remote access perimeter — often the first move against an organisation
from outside.
Onboarding: MANAGE-ENGINE-ADAUDIT-PLUS is ingested via Syslog (KV) (Bloo extractor 830).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=win-audit where sourcename='MANAGE-ENGINE-ADAUDIT-PLUS'
and action='NPS_USER_DENIED'
| duration 15m
| groupby user, networkpolicyname, reasoncode
| select user, networkpolicyname, reasoncode, count(*) as cnt
| having cnt > 10
Detects a threat raised by Zscaler Private Access. Because ZPA mediates every
connection to an internal application, a threat on a session means hostile activity
reaching private applications from a device that already passed authentication —
which points at the endpoint rather than the perimeter.
Onboarding: ZSCALER-SPA is ingested via the Zscaler connector (Bloo extractor 176).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=threat where sourcename='ZSCALER-SPA' and action='THREAT_DETECTED'
| groupby user, srcip, threat
connection to an internal application, a threat on a session means hostile activity
reaching private applications from a device that already passed authentication —
which points at the endpoint rather than the perimeter.
Onboarding: ZSCALER-SPA is ingested via the Zscaler connector (Bloo extractor 176).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=threat where sourcename='ZSCALER-SPA' and action='THREAT_DETECTED'
| groupby user, srcip, threat
Detects a Slack login from a source address without prior history for that account.
A compromised Slack account gives an attacker the organisation's informal channel —
where credentials, links and internal detail are shared far more freely than in
email — and is an effective base for internal phishing.
Onboarding: SLACK is ingested via Slack native connector (Bloo extractor 833).
Integration guide: https://bloo.io/docs/integrations/slack
BQL (Bloo Query Language):
stream=authentication where sourcename='SLACK' and action='LOGIN'
| groupby user, srcip, authproto, reason
A compromised Slack account gives an attacker the organisation's informal channel —
where credentials, links and internal detail are shared far more freely than in
email — and is an effective base for internal phishing.
Onboarding: SLACK is ingested via Slack native connector (Bloo extractor 833).
Integration guide: https://bloo.io/docs/integrations/slack
BQL (Bloo Query Language):
stream=authentication where sourcename='SLACK' and action='LOGIN'
| groupby user, srcip, authproto, reason
Detects Kerberos service ticket requests observed in network traffic analysis.
Seeing this on the wire rather than at the domain controller catches harvesting even
where domain controller auditing is incomplete, and it gives the source address
directly rather than requiring correlation.
Onboarding: NTA is ingested via Network Traffic Analysis (Bloo extractor 717).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=nta-connection where sourcename='NTA'
and action='KERBEROS_SERVICE_TICKET_REQUESTED'
| duration 1h
| groupby srcip, dstip
| select srcip, dstip, count(*) as cnt
| having cnt > 20
Seeing this on the wire rather than at the domain controller catches harvesting even
where domain controller auditing is incomplete, and it gives the source address
directly rather than requiring correlation.
Onboarding: NTA is ingested via Network Traffic Analysis (Bloo extractor 717).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=nta-connection where sourcename='NTA'
and action='KERBEROS_SERVICE_TICKET_REQUESTED'
| duration 1h
| groupby srcip, dstip
| select srcip, dstip, count(*) as cnt
| having cnt > 20
Detects creation of a GitHub Actions workflow. A workflow executes code on runners
with access to repository secrets, so a malicious one is both a code-execution
primitive and a route to every credential the repository holds — a supply chain
foothold reached entirely through legitimate platform features.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=github where sourcename='GITHUB' and action='WORKFLOW_CREATED'
| groupby target, repositoryid, headbranch, operationtype
with access to repository secrets, so a malicious one is both a code-execution
primitive and a route to every credential the repository holds — a supply chain
foothold reached entirely through legitimate platform features.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=github where sourcename='GITHUB' and action='WORKFLOW_CREATED'
| groupby target, repositoryid, headbranch, operationtype
Detects a role change on the Mimecast platform. A gateway administrator can read
quarantined mail, release held messages and alter policy — so this grant provides
both access to content and the ability to control what the organisation receives.
Onboarding: MIMECAST is ingested via Syslog (KV) (Bloo extractor 161).
Integration guide: https://bloo.io/docs/hypercloud/mimecast-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='MIMECAST' and action='ROLE_UPDATED'
| groupby user, srcip, reason
quarantined mail, release held messages and alter policy — so this grant provides
both access to content and the ability to control what the organisation receives.
Onboarding: MIMECAST is ingested via Syslog (KV) (Bloo extractor 161).
Integration guide: https://bloo.io/docs/hypercloud/mimecast-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='MIMECAST' and action='ROLE_UPDATED'
| groupby user, srcip, reason
Detects RADIUS authentication activity observed in network traffic, including the
MAC address of the requesting device. Seeing RADIUS on the wire catches
authentication against network infrastructure that often logs nowhere else —
switches, wireless controllers and VPN concentrators.
Onboarding: NTA is ingested via Network Traffic Analysis (Bloo extractor 717).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=nta-authentication-radius where sourcename='NTA'
| duration 1h
| groupby srcip, dstip, user, macaddress
MAC address of the requesting device. Seeing RADIUS on the wire catches
authentication against network infrastructure that often logs nowhere else —
switches, wireless controllers and VPN concentrators.
Onboarding: NTA is ingested via Network Traffic Analysis (Bloo extractor 717).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=nta-authentication-radius where sourcename='NTA'
| duration 1h
| groupby srcip, dstip, user, macaddress
Detects a privileged command executed through Centrify on Windows. Brokered
elevation records the command under the identity that requested it rather than the
shared administrative account it ran as, which restores attribution that local
Windows auditing frequently loses.
Onboarding: CENTRIFY-AUDITTRAIL-WINDOWS is ingested via Syslog (KV) (Bloo extractor 821).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CENTRIFY-AUDITTRAIL-WINDOWS'
and action='USER_COMMAND_EXECUTED'
| groupby user, targetuser, role, domain
elevation records the command under the identity that requested it rather than the
shared administrative account it ran as, which restores attribution that local
Windows auditing frequently loses.
Onboarding: CENTRIFY-AUDITTRAIL-WINDOWS is ingested via Syslog (KV) (Bloo extractor 821).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CENTRIFY-AUDITTRAIL-WINDOWS'
and action='USER_COMMAND_EXECUTED'
| groupby user, targetuser, role, domain
Page 7 of 16