Siddhant Mishra
@SiddhantMumbaiCompletionist
0 followers0 downloads36 copies0 likes234 views
159 detections
Filters
Last updated
All Time
Detection languages
159
Categories
32
17
16
13
12
Platforms
34
29
25
16
1
Products / Services
26
8
5
5
5
MITRE Techniques
44
34
33
23
21
Detects a user being added to a role within ClearPass. Role membership determines
what the network will permit an identity to reach, so granting a privileged role is
a network-layer privilege escalation that leaves no trace on any endpoint.
Additions outside provisioning hours, or by an account that does not normally
administer ClearPass, are the ones worth pursuing.
Onboarding: ARUBA-CLEARPASS is ingested via Syslog (CEF) (Bloo extractor 261).
Integration guide: https://bloo.io/docs/integrations/aruba-clearpass
BQL (Bloo Query Language):
stream=iam where sourcename='ARUBA-CLEARPASS' and action='USER_ADDED'
| groupby user, targetuser, role, srcip
what the network will permit an identity to reach, so granting a privileged role is
a network-layer privilege escalation that leaves no trace on any endpoint.
Additions outside provisioning hours, or by an account that does not normally
administer ClearPass, are the ones worth pursuing.
Onboarding: ARUBA-CLEARPASS is ingested via Syslog (CEF) (Bloo extractor 261).
Integration guide: https://bloo.io/docs/integrations/aruba-clearpass
BQL (Bloo Query Language):
stream=iam where sourcename='ARUBA-CLEARPASS' and action='USER_ADDED'
| groupby user, targetuser, role, srcip
Detects a burst of uploads to Box from a single account. Where mass download suggests
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
Detects a burst of uploads to Box from a single account. Where mass download suggests
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
Detects configuration changes on the SafeSquid gateway. Adding a bypass or relaxing
a category opens an egress route for the whole organisation, and because browsing
continues to work normally nobody reports anything.
Onboarding: SAFESQUID-SWG is ingested via Syslog (Bloo extractor 812).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='SAFESQUID-SWG'
and action='CONFIGURATION_CHANGED'
| groupby user
a category opens an egress route for the whole organisation, and because browsing
continues to work normally nobody reports anything.
Onboarding: SAFESQUID-SWG is ingested via Syslog (Bloo extractor 812).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='SAFESQUID-SWG'
and action='CONFIGURATION_CHANGED'
| groupby user
Detects a source repeatedly denied by WebSEAL authorisation. Denials indicate
requests for resources the identity is not entitled to reach, and a pattern of them
is enumeration of the protected application estate from a position already inside
the authentication boundary.
Onboarding: ISAM-WEBSEAL is ingested via Syslog (Bloo extractor 85).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webserver where sourcename='ISAM-WEBSEAL' and action='REQUEST_DENIED'
| duration 1h
| groupby srcip, user
| select srcip, user, distinct_count(url)
| having distinct_count_col1 > 15
requests for resources the identity is not entitled to reach, and a pattern of them
is enumeration of the protected application estate from a position already inside
the authentication boundary.
Onboarding: ISAM-WEBSEAL is ingested via Syslog (Bloo extractor 85).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webserver where sourcename='ISAM-WEBSEAL' and action='REQUEST_DENIED'
| duration 1h
| groupby srcip, user
| select srcip, user, distinct_count(url)
| having distinct_count_col1 > 15
Detects configuration changes on a Barracuda load balancer. Load balancer
configuration decides where traffic goes; altering a backend pool redirects users to
a destination of the attacker's choosing while the hostname and certificate they see
remain entirely legitimate.
Onboarding: BARRACUDA-LOADBALANCER is ingested via Syslog (CEF) (Bloo extractor 859).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='BARRACUDA-LOADBALANCER'
and action='CONFIGURATION_CHANGED'
| groupby user, config
configuration decides where traffic goes; altering a backend pool redirects users to
a destination of the attacker's choosing while the hostname and certificate they see
remain entirely legitimate.
Onboarding: BARRACUDA-LOADBALANCER is ingested via Syslog (CEF) (Bloo extractor 859).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='BARRACUDA-LOADBALANCER'
and action='CONFIGURATION_CHANGED'
| groupby user, config
Detects persistent blocked web requests from one internal source. A person stops
after a block; software does not. Sustained retries after blocking indicate
automation attempting to reach a destination it has been configured to use.
Onboarding: SAFESQUID-SWG is ingested via Syslog (Bloo extractor 812).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webfilter where sourcename='SAFESQUID-SWG' and action='URL_BLOCKED'
| duration 1h
| groupby srcip, user, category
| select srcip, user, category, count(*) as cnt
| having cnt > 25
after a block; software does not. Sustained retries after blocking indicate
automation attempting to reach a destination it has been configured to use.
Onboarding: SAFESQUID-SWG is ingested via Syslog (Bloo extractor 812).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webfilter where sourcename='SAFESQUID-SWG' and action='URL_BLOCKED'
| duration 1h
| groupby srcip, user, category
| select srcip, user, category, count(*) as cnt
| having cnt > 25
Detects one account downloading many files through GoAnywhere Managed File Transfer.
MFT platforms sit between organisations and hold exactly the data worth stealing —
payment files, payroll, partner exchanges — and have been the target of mass
exploitation campaigns precisely because they are internet-facing and rarely watched.
Onboarding: GOANYWHERE-MFT is ingested via Syslog (Bloo extractor 850).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=documents where sourcename='GOANYWHERE-MFT' and action='DOWNLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, distinct_count(file)
| having distinct_count_col1 > 20
MFT platforms sit between organisations and hold exactly the data worth stealing —
payment files, payroll, partner exchanges — and have been the target of mass
exploitation campaigns precisely because they are internet-facing and rarely watched.
Onboarding: GOANYWHERE-MFT is ingested via Syslog (Bloo extractor 850).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=documents where sourcename='GOANYWHERE-MFT' and action='DOWNLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, distinct_count(file)
| having distinct_count_col1 > 20
Detects unusual volumes of redirects through WebSEAL. Open or manipulable redirects
on an authentication gateway are valuable to an attacker: a link that genuinely
begins on the organisation's own trusted domain will survive scrutiny that an
external link would not.
Onboarding: ISAM-WEBSEAL is ingested via Syslog (Bloo extractor 85).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webserver where sourcename='ISAM-WEBSEAL' and action='REQUEST_REDIRECTED'
| duration 1h
| groupby srcip, url, uriquery, returncode
on an authentication gateway are valuable to an attacker: a link that genuinely
begins on the organisation's own trusted domain will survive scrutiny that an
external link would not.
Onboarding: ISAM-WEBSEAL is ingested via Syslog (Bloo extractor 85).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webserver where sourcename='ISAM-WEBSEAL' and action='REQUEST_REDIRECTED'
| duration 1h
| groupby srcip, url, uriquery, returncode
Detects an unusual rate of terminated connections at the BIG-IP. Mass termination
can indicate resource exhaustion, a denial of service in progress, or an attacker
disrupting the application tier — and the load balancer sees it before the
application does.
Onboarding: F5BIGIP is ingested via Syslog (Bloo extractor 81).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=firewall where sourcename='F5BIGIP' and action='CONNECTION_TERMINATED'
| duration 10m
| groupby srcip, dstip, dstport, app
| select srcip, dstip, dstport, app, count(*) as cnt
| having cnt > 100
can indicate resource exhaustion, a denial of service in progress, or an attacker
disrupting the application tier — and the load balancer sees it before the
application does.
Onboarding: F5BIGIP is ingested via Syslog (Bloo extractor 81).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=firewall where sourcename='F5BIGIP' and action='CONNECTION_TERMINATED'
| duration 10m
| groupby srcip, dstip, dstport, app
| select srcip, dstip, dstport, app, count(*) as cnt
| having cnt > 100
Page 7 of 16