Merge pull request #1581 from splunk/deleted_wrong_merged_detections

remove detections which was pushed to develop by accident

detections/cloud/gdrive_suspicious_file_sharing.yml

@@ -1,53 +0,0 @@
-name: Gdrive suspictious file sharing
-id: b842f557-c7b3-4b92-aa34-8243217a6685
-version: 1
-date: '2021-08-19'
-author: Rod Soto, Splunk
-type: Anomaly
-datamodel:
-- Endpoint
-- Email
-- Updates
-description: This search can help the detection of compromised accounts or internal users sending malicious documents via GSuite file sharing.
-search: 'sourcetype="gsuite:drive:json" parameters.target_user=* name=change_user_access | spath "parameters.owner" | search "parameters.owner"="*" | stats  count by src_ip parameters.owner parameters.target_user parameters.doc_type parameters.doc_title | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
-  | `gdrive_suspicious_file_sharing_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs related to gsuite (gsuite:drive:json) having the file sharing metadata like file type, source owner, destination target user, description, etc.
-known_false_positives: This search will also produce normal activity statistics. Fields such as parameters.doc_type and parameters.doc_title may give away
-phishing intent. 
-references:
-- https://www.csoonline.com/article/3274546/cybercriminals-impersonate-popular-file-sharing-services-to-take-over-email-accounts.html
-tags:
-  analytic_story:
-  - DevSecOps
-  dataset:
-  - UPDATE_DATASET_URL
-  kill_chain_phases:
-  - Exploitation
-  mitre_attack_id:
-  - T1566
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - parameters.target_user
-  - parameters.owner
-  security_domain: Cloud
-  impact: 50
-  confidence: 50
-  # (impact * confidence)/100
-  risk_score: 25
-  context:
-  - Source:Cloud
-  - Stage:Initial Access
-  message: N/A
-  observable:
-  - name: parameters.owner
-    type: User
-    role:
-    - attacker
-  - name: parameters.target_user
-    type: User
-    role:
-    - Victim

detections/cloud/gsuite_suspicious_calendar_invite.yml

@@ -1,56 +0,0 @@
-name: GSuite suspicious calendar invite
-id: b842f557-c7b3-4b92-aa34-8243217a6685
-version: 1
-date: '2021-08-19'
-author: Rod Soto, Splunk
-type: Anomaly
-datamodel:
-- Endpoint
-- Email
-- Updates
-description: This search can help the detection of compromised accounts or internal users sending suspcious calendar invites via GSuite calendar. These
-invites may contain malicious links or attachments.
-search: 'sourcetype="gsuite:calendar:json" email=* parameters.event_title!=null | stats  count by email ip_address source name parameters.api_kind parameters.event_title parameters.organizer_calendar_id parameters.target_calendar_id parameters.user_agent parameters.event_response_status   | convert  timeformat="%Y-%m-%dT%H:%M:%S" ctime(firstTime)
-| convert  timeformat="%Y-%m-%dT%H:%M:%S" ctime(lastTime)| `gsuite_suspicious_calendar_invite_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs related to gsuite (gsuite:drive:json) having the file sharing metadata like file type, source owner, destination target user, description, etc.
-known_false_positives: This search will also produce normal activity statistics. Fields such as email, ip address, name, parameters.organizer_calendar_id, parameters.target_calendar_id and parameters.event_title may give away
-phishing intent.
-references:
-- https://www.techrepublic.com/article/how-to-avoid-the-dreaded-google-calendar-malicious-invite-issue/
-tags:
-  analytic_story:
-  - DevSecOps
-  dataset:
-  - UPDATE_DATASET_URL
-  kill_chain_phases:
-  - Exploitation
-  mitre_attack_id:
-  - T1566
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - email
-  - parameters.organizer_calendar_id
-  - parameters.target_calendar_id
-  - parameters.event_title
-  security_domain: Cloud
-  impact: 50
-  confidence: 50
-  # (impact * confidence)/100
-  risk_score: 25
-  context:
-  - Source:Cloud
-  - Stage:Initial Access
-  message: N/A
-  observable:
-  - name: parameters.organizer_calendar_id
-    type: User
-    role:
-    - attacker
-  - name: parameters.target_calendar_id 
-    type: User
-    role:
-    - Victim