Branch was auto-updated.

detections/endpoint/gsuite_drive_share_in_external_email.yml

@@ -0,0 +1,65 @@
+name: Gsuite Drive Share In External Email
+id: f6ee02d6-fea0-11eb-b2c2-acde48001122
+version: 1
+date: '2021-08-16'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This search is to detect suspicious google drive or google docs files shared outside or externally. 
+  This behavior might be a good hunting query to monitor exfitration of data made by an attacker or insider to a targetted machine.
+search: '`gsuite_drive` NOT (email IN("", "null")) 
+  | rex field=parameters.owner "[^@]+@(?<src_domain>[^@]+)"  
+  | rex field=email "[^@]+@(?<dest_domain>[^@]+)"
+  | where src_domain = "internal_test_email.com" and not dest_domain = "internal_test_email.com" 
+  | stats values(parameters.doc_title) as doc_title, values(parameters.doc_type) as doc_types, values(email) as dst_email_list, values(parameters.visibility) as visibility, count min(_time) as firstTime max(_time) as lastTime by parameters.owner
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `gsuite_drive_share_in_external_email_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs related to gsuite having the file attachment metadata like file type, file 
+  extension, source email, destination email, num of attachment and etc.
+known_false_positives: network admin or normal user may share files to customer and external team.
+references:
+- https://www.redhat.com/en/topics/devops/what-is-devsecops
+tags:
+  analytic_story:
+  - DevSecOps
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1567.002/gsuite_share_drive/gdrive_share_external.log
+  kill_chain_phases:
+  - Exfiltration
+  mitre_attack_id:
+  - T1567.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - parameters.doc_title
+  - src_domain
+  - dest_domain
+  - email
+  - parameters.visibility
+  - parameters.owner
+  - parameters.doc_type
+  security_domain: endpoint
+  impact: 30
+  confidence: 30
+  # (impact * confidence)/100
+  risk_score: 9
+  context:
+  - Source:Endpoint
+  - Stage:Reconnaissance
+  message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$
+  observable:
+  - name: parameters.owner
+    type: User
+    role:
+    - attacker
+  - name: email
+    type: User
+    role:
+    - Victim
+  

detections/endpoint/gsuite_email_suspicious_attachment.yml

@@ -0,0 +1,66 @@
+name: GSuite Email Suspicious Attachment
+id: 6d663014-fe92-11eb-ab07-acde48001122
+version: 1
+date: '2021-08-16'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: This search is to detect a suspicious attachment file extension in Gsuite email that may related to spear phishing attack. 
+  This file type is commonly used by malware to lure user to click on it to execute malicious code to compromised targetted machine. 
+  But this search can also catch some normal files related to this file type that maybe send by employee or network admin.
+ 
+search: '`gsuite_gmail` "attachment{}.file_extension_type" IN ("pl", "py", "rb", "sh", "bat", "exe", "dll", "cpl", "com", "js", "vbs", "ps1", "reg","swf", "cmd", "go") 
+  | stats count min(_time) as firstTime max(_time) as lastTime values(attachment{}.file_extension_type) as email_attachments, values(attachment{}.sha256) as attachment_sha256, values(payload_size) as payload_size by   
+  destination{}.service num_message_attachments  subject destination{}.address source.address
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `gsuite_email_suspicious_attachment_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs related to gsuite having the file attachment metadata like file type, file 
+  extension, source email, destination email, num of attachment and etc.
+known_false_positives: network admin and normal user may send this file attachment as part of their day to day work. having a good protocol 
+  in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack.
+references:
+- https://www.redhat.com/en/topics/devops/what-is-devsecops
+tags:
+  analytic_story:
+  - DevSecOps
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_attachment_ext/gsuite_gmail_file_ext.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1566.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - attachment{}.file_extension_type 
+  - attachment{}.sha256 
+  - destination{}.service 
+  - num_message_attachments 
+  - payload_size 
+  - subject 
+  - destination{}.address 
+  - source.address
+  security_domain: endpoint
+  impact: 70
+  confidence: 70 
+  # (impact * confidence)/100
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - Stage:Reconnaissance
+  message: suspicious email from $source.address$ to $destination{}.address$
+  observable:
+  - name: source.address
+    type: User
+    role:
+    - attacker
+  - name: destination{}.address 
+    type: User
+    role:
+    - Victim

detections/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.yml

@@ -0,0 +1,63 @@
+name: Gsuite Outbound Email With Attachment To External Domain
+id: dc4dc3a8-ff54-11eb-8bf7-acde48001122
+version: 1
+date: '2021-08-17'
+author: Teoderick Contreras, Stanislav Miskovic, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+- Email
+description: This search is to detect a suspicious outbound e-mail from internal email to external email domain. 
+  This can be a good hunting query to monitor insider or outbound email traffic for not common domain e-mail.
+  The idea is to parse the domain of destination email check if there is a minimum outbound traffic < 20 with attachment.
+search: '`gsuite_gmail` num_message_attachments > 0 
+  | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)"  
+  | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)"  
+  | where source_domain="internal_test_email.com" and not dest_domain="internal_test_email.com" 
+  | stats values(subject) as subject, values(source.from_header_address) as src_domain_list, count as numEvents, dc(source.from_header_address) as numSrcAddresses, 
+  min(_time) as firstTime max(_time) as lastTime by dest_domain  
+  | where numSrcAddresses < 20 |sort - numSrcAddresses
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `gsuite_outbound_email_with_attachment_to_external_domain_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs related to gsuite having the file attachment metadata like file type, file 
+  extension, source email, destination email, num of attachment and etc.
+known_false_positives: network admin and normal user may send this file attachment as part of their day to day work. having a good protocol 
+  in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack.
+references:
+- https://www.redhat.com/en/topics/devops/what-is-devsecops
+tags:
+  analytic_story:
+  - DevSecOps
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_outbound_email_to_external/gsuite_external_domain.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  -  T1048.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 30
+  confidence: 30
+  # (impact * confidence)/100
+  risk_score: 9
+  context:
+  - Source:Endpoint
+  - Stage:Reconnaissance
+  message: suspicious email from $source.address$ to $destination{}.address$
+  observable:
+  - name: source.address
+    type: User
+    role:
+    - attacker
+  - name: destination{}.address 
+    type: User
+    role:
+    - Victim
+  

macros/gsuite_drive.yml

@@ -0,0 +1,5 @@
+definition: sourcetype=gsuite:drive:json
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: gsuite_drive
+

macros/gsuite_gmail.yml

@@ -0,0 +1,4 @@
+definition: sourcetype=gsuite:gmail:bigquery
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: gsuite_gmail

tests/endpoint/gsuite_drive_share_in_external_email.test.yml

@@ -0,0 +1,12 @@
+name: Gsuite Drive Share In External Email Unit Test
+tests:
+- name: Gsuite Drive Share In External Email
+  file: endpoint/gsuite_drive_share_in_external_email.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: gdrive_share_external.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1567.002/gsuite_share_drive/gdrive_share_external.log
+    source: http:gsuite
+    sourcetype: gsuite:drive:json 

tests/endpoint/gsuite_email_suspicious_attachment.test.yml

@@ -0,0 +1,12 @@
+name: GSuite Email Suspicious Attachment Unit Test
+tests:
+- name: GSuite Email Suspicious Attachment
+  file: endpoint/gsuite_email_suspicious_attachment.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: gsuite_gmail_file_ext.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_attachment_ext/gsuite_gmail_file_ext.log
+    source: http:gsuite
+    sourcetype: gsuite:gmail:bigquery

tests/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.test.yml

@@ -0,0 +1,12 @@
+name: Gsuite Outbound Email With Attachment To External Domain Unit Test
+tests:
+- name: Gsuite Outbound Email With Attachment To External Domain
+  file: endpoint/gsuite_outbound_email_with_attachment_to_external_domain.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: gsuite_external_domain.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_outbound_email_to_external/gsuite_external_domain.log
+    source: http:gsuite
+    sourcetype: gsuite:gmail:bigquery