name: Email Attachments With Lots Of Spaces
id: 56e877a6-1455-4479-ada6-0550dc1e22f8
version: 2
date: '2017-09-19'
author: David Dorsey, Splunk
type: batch
datamodel:
- Email
description: Attackers often use spaces as a means to obfuscate an attachment's file
  extension. This search looks for messages with email attachments that have many
  spaces within the file names.
search: '| tstats `security_content_summariesonly` count values(All_Email.recipient)
  as recipient_address min(_time) as firstTime max(_time) as lastTime from datamodel=Email
  where All_Email.file_name="*" by All_Email.src_user, All_Email.file_name All_Email.message_id
  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name("All_Email")`
  | eval space_ratio = (mvcount(split(file_name," "))-1)/len(file_name) | search space_ratio
  >= 0.1 |  rex field=recipient_address "(?<recipient_user>.*)@" | `email_attachments_with_lots_of_spaces_filter`'
how_to_implement: "You need to ingest data from emails. Specifically, the sender's\
  \ address and the file names of any attachments must be mapped to the Email data\
  \ model. The threshold ratio is set to 10%, but this value can be configured to\
  \ suit each environment. \\\n **Splunk Phantom Playbook Integration**\\\nIf Splunk\
  \ Phantom is also configured in your environment, a playbook called \"Suspicious\
  \ Email Attachment Investigate and Delete\" can be configured to run when any results\
  \ are found by this detection search. To use this integration, install the Phantom\
  \ App for Splunk `https://splunkbase.splunk.com/app/3411/` and add the correct hostname\
  \ to the \"Phantom Instance\" field in the Adaptive Response Actions when configuring\
  \ this detection search. The notable event will be sent to Phantom and the playbook\
  \ will gather further information about the file attachment and its network behaviors.\
  \ If Phantom finds malicious behavior and an analyst approves of the results, the\
  \ email will be deleted from the user's inbox."
known_false_positives: None at this time
references: []
tags:
  analytic_story:
  - 'Emotet Malware  DHS Report TA18-201A '
  - Suspicious Emails
  asset_type: Endpoint
  cis20:
  - CIS 7
  kill_chain_phases:
  - Delivery
  nist:
  - PR.IP
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - All_Email.recipient
  - All_Email.file_name
  - All_Email.src_user
  - All_Email.file_name
  - All_Email.message_id
  security_domain: network
