From e9d1a8525118e27a1e6e65539d606913d8ef9ef4 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Sun, 24 Oct 2021 12:08:39 -0700 Subject: [PATCH 1/6] prforbhavingsuiteexperimentalsearches --- .../cloud/gdrive_suspicious_file_sharing.yml | 37 ++++++++++++++++++ .../gsuite_suspicious_calendar_invite.yml | 38 +++++++++++++++++++ 2 files changed, 75 insertions(+) create mode 100644 detections/experimental/cloud/gdrive_suspicious_file_sharing.yml create mode 100644 detections/experimental/cloud/gsuite_suspicious_calendar_invite.yml diff --git a/detections/experimental/cloud/gdrive_suspicious_file_sharing.yml b/detections/experimental/cloud/gdrive_suspicious_file_sharing.yml new file mode 100644 index 0000000000..c6c81e0b38 --- /dev/null +++ b/detections/experimental/cloud/gdrive_suspicious_file_sharing.yml @@ -0,0 +1,37 @@ +name: Gdrive suspicious file sharing +id: a7131dae-34e3-11ec-a2de-acde48001122 +version: 1 +date: '2021-10-24' +author: Rod Soto, Teoderick Contreras +type: Anomaly +datamodel: [] +description: This search can help the detection of compromised accounts or internal,external users sending malicious documents via GSuite file sharing. +search: 'source="http:gsuite" name=change_user_access parameters.target_user = "*yourdomain*" parameters.owner !="*yourdomain.com" +| spath "parameters.owner" +| search "parameters.owner"="*" +| stats count values("parameters.owner") as owner values("parameters.target_user") as target dc("parameters.target_user") as distinct_target by src_ip parameters.doc_type parameters.doc_title |where count > 100 | `gdrive_suspicious_file_sharing_filter`' +how_to_implement: Need to implement Gsuite logging targeting Google suite drive activity. +known_false_positives: This is an anomaly search, you must specify your domain in the parameters so it either filters outside domains or focus on internal domains. This search may also help investigate compromise of accounts. By looking at for example source ip addresses, document titles and abnormal number of shares and shared target users. +references: +- https://www.splunk.com/en_us/blog/security/investigating-gsuite-phishing-attacks-with-splunk.html +tags: + analytic_story: + - Spearphishing Attachments + dataset: + - [] + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - src_ip + - parameters.owner + - parameters.target_user + - parameters.doc_title + - parameters.doc_type + security_domain: threat diff --git a/detections/experimental/cloud/gsuite_suspicious_calendar_invite.yml b/detections/experimental/cloud/gsuite_suspicious_calendar_invite.yml new file mode 100644 index 0000000000..3a9ad0cd7c --- /dev/null +++ b/detections/experimental/cloud/gsuite_suspicious_calendar_invite.yml @@ -0,0 +1,38 @@ +name: Gsuite suspicious calendar invite +id: 03cdd68a-34fb-11ec-9bd3-acde48001122 +version: 1 +date: '2021-10-24' +author: Rod Soto, Teoderick Contreras +type: Anomaly +datamodel: [] +description: +This search can help the detection of compromised accounts or internal users sending suspcious calendar invites via GSuite calendar. These +invites may contain malicious links or attachments. +search: 'source="http:gsuite" email!="*yourdomain.com" AND email=*@* parameters.event_title!=null "parameters.target_calendar_id"="*@yourdomain.com" | stats count values(parameters.target_calendar_id) by email parameters.event_title | where count > 100 | `gsuite_suspicious_calendar_invite_filter`' +how_to_implement: In order to successfully implement this search, you need to be ingesting logs related to gsuite (gsuite:calendar:json) having the file sharing metadata like file type, source owner, destination target user, description, etc. This search can also be made more specific by selecting specific emails, subdomains +timeframe, organizational units, targeted user, etc. +known_false_positives: This search will also produce normal activity statistics. Fields such as email, ip address, name, parameters.organizer_calendar_id, parameters.target_calendar_id and parameters.event_title may give away +phishing intent.For more specific results use email parameter. +references: +- https://www.techrepublic.com/article/how-to-avoid-the-dreaded-google-calendar-malicious-invite-issue/ +- https://gcn.com/articles/2012/09/26/20-most-common-words-phishing-attacks.aspx +tags: + analytic_story: + - Spearphishing Attachments + dataset: + - [] + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - email + - parameters.event_title + - parameters.target_calendar_id + - parameters.event_title + security_domain: threat From 0539ea52f2b344f9c76a37aa68069a9dbfb9d5b3 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 1 Nov 2021 13:30:50 -0700 Subject: [PATCH 2/6] macro update --- .../experimental/cloud/gdrive_suspicious_file_sharing.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/experimental/cloud/gdrive_suspicious_file_sharing.yml b/detections/experimental/cloud/gdrive_suspicious_file_sharing.yml index c6c81e0b38..a0983f386c 100644 --- a/detections/experimental/cloud/gdrive_suspicious_file_sharing.yml +++ b/detections/experimental/cloud/gdrive_suspicious_file_sharing.yml @@ -6,12 +6,12 @@ author: Rod Soto, Teoderick Contreras type: Anomaly datamodel: [] description: This search can help the detection of compromised accounts or internal,external users sending malicious documents via GSuite file sharing. -search: 'source="http:gsuite" name=change_user_access parameters.target_user = "*yourdomain*" parameters.owner !="*yourdomain.com" +search: '`gsuite_drive` name=change_user_access parameters.target_user = "*yourdomain*" parameters.owner !="*yourdomain.com" | spath "parameters.owner" | search "parameters.owner"="*" | stats count values("parameters.owner") as owner values("parameters.target_user") as target dc("parameters.target_user") as distinct_target by src_ip parameters.doc_type parameters.doc_title |where count > 100 | `gdrive_suspicious_file_sharing_filter`' -how_to_implement: Need to implement Gsuite logging targeting Google suite drive activity. -known_false_positives: This is an anomaly search, you must specify your domain in the parameters so it either filters outside domains or focus on internal domains. This search may also help investigate compromise of accounts. By looking at for example source ip addresses, document titles and abnormal number of shares and shared target users. +how_to_implement: Need to implement Gsuite logging targeting Google suite drive activity. In order for the search to work for your environment please update `yourdomain.com` value in the query with the domain relavant for your organization. +known_false_positives: This is an anomaly search, you must specify your domain in the parameters so it either filters outside domains or focus on internal domains. This search may also help investigate compromise of accounts. By looking at for example source ip addresses, document titles and abnormal number of shares and shared target users. references: - https://www.splunk.com/en_us/blog/security/investigating-gsuite-phishing-attacks-with-splunk.html tags: From ad5afdc3dcc49159ff706966b18d2fd87ec069e4 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 1 Nov 2021 16:14:12 -0700 Subject: [PATCH 3/6] calendar search --- .../cloud/gdrive_suspicious_file_sharing.yml | 12 ++++++------ lookups/gsuite_calendar.yaml | 5 +++++ 2 files changed, 11 insertions(+), 6 deletions(-) create mode 100644 lookups/gsuite_calendar.yaml diff --git a/detections/experimental/cloud/gdrive_suspicious_file_sharing.yml b/detections/experimental/cloud/gdrive_suspicious_file_sharing.yml index a0983f386c..14a125e99b 100644 --- a/detections/experimental/cloud/gdrive_suspicious_file_sharing.yml +++ b/detections/experimental/cloud/gdrive_suspicious_file_sharing.yml @@ -3,13 +3,12 @@ id: a7131dae-34e3-11ec-a2de-acde48001122 version: 1 date: '2021-10-24' author: Rod Soto, Teoderick Contreras -type: Anomaly +type: Hunting datamodel: [] -description: This search can help the detection of compromised accounts or internal,external users sending malicious documents via GSuite file sharing. -search: '`gsuite_drive` name=change_user_access parameters.target_user = "*yourdomain*" parameters.owner !="*yourdomain.com" -| spath "parameters.owner" -| search "parameters.owner"="*" -| stats count values("parameters.owner") as owner values("parameters.target_user") as target dc("parameters.target_user") as distinct_target by src_ip parameters.doc_type parameters.doc_title |where count > 100 | `gdrive_suspicious_file_sharing_filter`' +description: This search can help the detection of compromised accounts or internal users sharing potentially malicious/classified documents with users outside your organization via GSuite file sharing . +search: '`gsuite_drive` name=change_user_access +| rename parameters.* as * | search email = "*@yourdomain.com" target_user != "*@yourdomain.com" +| stats count values(owner) as owner values(target_user) as target values(doc_type) as doc_type values(doc_title) as doc_title dc(target_user) as distinct_target by src_ip email | where distinct_target > 50 | `gdrive_suspicious_file_sharing_filter`' how_to_implement: Need to implement Gsuite logging targeting Google suite drive activity. In order for the search to work for your environment please update `yourdomain.com` value in the query with the domain relavant for your organization. known_false_positives: This is an anomaly search, you must specify your domain in the parameters so it either filters outside domains or focus on internal domains. This search may also help investigate compromise of accounts. By looking at for example source ip addresses, document titles and abnormal number of shares and shared target users. references: @@ -17,6 +16,7 @@ references: tags: analytic_story: - Spearphishing Attachments + - Data Exfiltration dataset: - [] kill_chain_phases: diff --git a/lookups/gsuite_calendar.yaml b/lookups/gsuite_calendar.yaml new file mode 100644 index 0000000000..a4ccb0c364 --- /dev/null +++ b/lookups/gsuite_calendar.yaml @@ -0,0 +1,5 @@ +definition: sourcetype=gsuite:calendar:json +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: gsuite_calendar + From 0a9c396e08d76c1474f0231bccb76d6332f66e9a Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 2 Nov 2021 18:03:21 -0700 Subject: [PATCH 4/6] search update --- .../cloud/gsuite_suspicious_calendar_invite.yml | 6 +++--- macros/gsuite_calendar.yml | 5 +++++ 2 files changed, 8 insertions(+), 3 deletions(-) create mode 100644 macros/gsuite_calendar.yml diff --git a/detections/experimental/cloud/gsuite_suspicious_calendar_invite.yml b/detections/experimental/cloud/gsuite_suspicious_calendar_invite.yml index 3a9ad0cd7c..e1132d2c01 100644 --- a/detections/experimental/cloud/gsuite_suspicious_calendar_invite.yml +++ b/detections/experimental/cloud/gsuite_suspicious_calendar_invite.yml @@ -3,14 +3,14 @@ id: 03cdd68a-34fb-11ec-9bd3-acde48001122 version: 1 date: '2021-10-24' author: Rod Soto, Teoderick Contreras -type: Anomaly +type: Hunting datamodel: [] description: This search can help the detection of compromised accounts or internal users sending suspcious calendar invites via GSuite calendar. These invites may contain malicious links or attachments. -search: 'source="http:gsuite" email!="*yourdomain.com" AND email=*@* parameters.event_title!=null "parameters.target_calendar_id"="*@yourdomain.com" | stats count values(parameters.target_calendar_id) by email parameters.event_title | where count > 100 | `gsuite_suspicious_calendar_invite_filter`' +search: '`gsuite_calendar` |bin span=5m _time |rename parameters.* as * |search target_calendar_id!=null email="*yourdomain.com"| stats count values(target_calendar_id) values(event_title) values(event_guest) by email _time | where count >100| `gsuite_suspicious_calendar_invite_filter`' how_to_implement: In order to successfully implement this search, you need to be ingesting logs related to gsuite (gsuite:calendar:json) having the file sharing metadata like file type, source owner, destination target user, description, etc. This search can also be made more specific by selecting specific emails, subdomains -timeframe, organizational units, targeted user, etc. +timeframe, organizational units, targeted user, etc. In order for the search to work for your environment please update `yourdomain.com` value in the query with the domain relavant for your organization. known_false_positives: This search will also produce normal activity statistics. Fields such as email, ip address, name, parameters.organizer_calendar_id, parameters.target_calendar_id and parameters.event_title may give away phishing intent.For more specific results use email parameter. references: diff --git a/macros/gsuite_calendar.yml b/macros/gsuite_calendar.yml new file mode 100644 index 0000000000..a4ccb0c364 --- /dev/null +++ b/macros/gsuite_calendar.yml @@ -0,0 +1,5 @@ +definition: sourcetype=gsuite:calendar:json +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: gsuite_calendar + From 767461b47defa6aa893c8b6b26ab80e5a8e089ad Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 2 Nov 2021 18:04:52 -0700 Subject: [PATCH 5/6] remove wrong lookup --- lookups/gsuite_calendar.yaml | 5 ----- 1 file changed, 5 deletions(-) delete mode 100644 lookups/gsuite_calendar.yaml diff --git a/lookups/gsuite_calendar.yaml b/lookups/gsuite_calendar.yaml deleted file mode 100644 index a4ccb0c364..0000000000 --- a/lookups/gsuite_calendar.yaml +++ /dev/null @@ -1,5 +0,0 @@ -definition: sourcetype=gsuite:calendar:json -description: customer specific splunk configurations(eg- index, source, sourcetype). - Replace the macro definition with configurations for your Splunk Environmnent. -name: gsuite_calendar - From 0dfff9783096961230969e7b3974ef8202d691ab Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 2 Nov 2021 18:11:32 -0700 Subject: [PATCH 6/6] yml errors --- .../cloud/gsuite_suspicious_calendar_invite.yml | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/detections/experimental/cloud/gsuite_suspicious_calendar_invite.yml b/detections/experimental/cloud/gsuite_suspicious_calendar_invite.yml index e1132d2c01..fccb0fa57e 100644 --- a/detections/experimental/cloud/gsuite_suspicious_calendar_invite.yml +++ b/detections/experimental/cloud/gsuite_suspicious_calendar_invite.yml @@ -5,14 +5,10 @@ date: '2021-10-24' author: Rod Soto, Teoderick Contreras type: Hunting datamodel: [] -description: -This search can help the detection of compromised accounts or internal users sending suspcious calendar invites via GSuite calendar. These -invites may contain malicious links or attachments. +description: This search can help the detection of compromised accounts or internal users sending suspcious calendar invites via GSuite calendar. These invites may contain malicious links or attachments. search: '`gsuite_calendar` |bin span=5m _time |rename parameters.* as * |search target_calendar_id!=null email="*yourdomain.com"| stats count values(target_calendar_id) values(event_title) values(event_guest) by email _time | where count >100| `gsuite_suspicious_calendar_invite_filter`' -how_to_implement: In order to successfully implement this search, you need to be ingesting logs related to gsuite (gsuite:calendar:json) having the file sharing metadata like file type, source owner, destination target user, description, etc. This search can also be made more specific by selecting specific emails, subdomains -timeframe, organizational units, targeted user, etc. In order for the search to work for your environment please update `yourdomain.com` value in the query with the domain relavant for your organization. -known_false_positives: This search will also produce normal activity statistics. Fields such as email, ip address, name, parameters.organizer_calendar_id, parameters.target_calendar_id and parameters.event_title may give away -phishing intent.For more specific results use email parameter. +how_to_implement: In order to successfully implement this search, you need to be ingesting logs related to gsuite (gsuite:calendar:json) having the file sharing metadata like file type, source owner, destination target user, description, etc. This search can also be made more specific by selecting specific emails, subdomains timeframe, organizational units, targeted user, etc. In order for the search to work for your environment please update `yourdomain.com` value in the query with the domain relavant for your organization. +known_false_positives: This search will also produce normal activity statistics. Fields such as email, ip address, name, parameters.organizer_calendar_id, parameters.target_calendar_id and parameters.event_title may give away phishing intent.For more specific results use email parameter. references: - https://www.techrepublic.com/article/how-to-avoid-the-dreaded-google-calendar-malicious-invite-issue/ - https://gcn.com/articles/2012/09/26/20-most-common-words-phishing-attacks.aspx