DreamHost File Manager breach: FTP/SFTP passwords and some webmail sessions stolen
https://sockanalyst.com/patch-now/dreamhost-file-manager-ftp-webmail-breach

Splunk
index=* (sourcetype=*ftp* OR sourcetype=*webmail* OR sourcetype=*linux_secure* OR index=email)
(user="*dreamhost*" OR dest_host="*dreamhost*" OR url="*files.dreamhost.com*" OR subject="*DreamHost*" OR subject="*File Manager*")
| stats count min(_time) as first max(_time) as last values(src) as src values(action) as action by user, dest, sourcetype

Sentinel
union isfuzzy=true
 (SigninLogs | where AppDisplayName has_any ("DreamHost","FTP","SFTP","webmail") or IPAddress != ""),
 (EmailEvents | where Subject has_any ("DreamHost","File Manager","password reset") and SenderFromDomain !endswith "dreamhost.com")
| where TimeGenerated >= ago(90d)
| summarize Events=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by UserPrincipalName=coalesce(UserPrincipalName, RecipientEmailAddress), AppDisplayName, IPAddress=coalesce(IPAddress, tostring(SenderIPv4)), Subject
// Triage: unexpected FTP/webmail auth and DreamHost-themed phishing outside dreamhost.com