diff --git a/detections/endpoint/gsuite_drive_share_in_external_email.yml b/detections/endpoint/gsuite_drive_share_in_external_email.yml new file mode 100644 index 0000000000..124f44d239 --- /dev/null +++ b/detections/endpoint/gsuite_drive_share_in_external_email.yml @@ -0,0 +1,65 @@ +name: Gsuite Drive Share In External Email +id: f6ee02d6-fea0-11eb-b2c2-acde48001122 +version: 1 +date: '2021-08-16' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This search is to detect suspicious google drive or google docs files shared outside or externally. + This behavior might be a good hunting query to monitor exfitration of data made by an attacker or insider to a targetted machine. +search: '`gsuite_drive` NOT (email IN("", "null")) + | rex field=parameters.owner "[^@]+@(?[^@]+)" + | rex field=email "[^@]+@(?[^@]+)" + | where src_domain = "internal_test_email.com" and not dest_domain = "internal_test_email.com" + | stats values(parameters.doc_title) as doc_title, values(parameters.doc_type) as doc_types, values(email) as dst_email_list, values(parameters.visibility) as visibility, count min(_time) as firstTime max(_time) as lastTime by parameters.owner + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `gsuite_drive_share_in_external_email_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs related to gsuite having the file attachment metadata like file type, file + extension, source email, destination email, num of attachment and etc. +known_false_positives: network admin or normal user may share files to customer and external team. +references: +- https://www.redhat.com/en/topics/devops/what-is-devsecops +tags: + analytic_story: + - DevSecOps + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1567.002/gsuite_share_drive/gdrive_share_external.log + kill_chain_phases: + - Exfiltration + mitre_attack_id: + - T1567.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - parameters.doc_title + - src_domain + - dest_domain + - email + - parameters.visibility + - parameters.owner + - parameters.doc_type + security_domain: endpoint + impact: 30 + confidence: 30 + # (impact * confidence)/100 + risk_score: 9 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$ + observable: + - name: parameters.owner + type: User + role: + - attacker + - name: email + type: User + role: + - Victim + \ No newline at end of file diff --git a/detections/endpoint/gsuite_email_suspicious_attachment.yml b/detections/endpoint/gsuite_email_suspicious_attachment.yml new file mode 100644 index 0000000000..672cb53919 --- /dev/null +++ b/detections/endpoint/gsuite_email_suspicious_attachment.yml @@ -0,0 +1,66 @@ +name: GSuite Email Suspicious Attachment +id: 6d663014-fe92-11eb-ab07-acde48001122 +version: 1 +date: '2021-08-16' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This search is to detect a suspicious attachment file extension in Gsuite email that may related to spear phishing attack. + This file type is commonly used by malware to lure user to click on it to execute malicious code to compromised targetted machine. + But this search can also catch some normal files related to this file type that maybe send by employee or network admin. + +search: '`gsuite_gmail` "attachment{}.file_extension_type" IN ("pl", "py", "rb", "sh", "bat", "exe", "dll", "cpl", "com", "js", "vbs", "ps1", "reg","swf", "cmd", "go") + | stats count min(_time) as firstTime max(_time) as lastTime values(attachment{}.file_extension_type) as email_attachments, values(attachment{}.sha256) as attachment_sha256, values(payload_size) as payload_size by + destination{}.service num_message_attachments subject destination{}.address source.address + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `gsuite_email_suspicious_attachment_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs related to gsuite having the file attachment metadata like file type, file + extension, source email, destination email, num of attachment and etc. +known_false_positives: network admin and normal user may send this file attachment as part of their day to day work. having a good protocol + in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack. +references: +- https://www.redhat.com/en/topics/devops/what-is-devsecops +tags: + analytic_story: + - DevSecOps + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_attachment_ext/gsuite_gmail_file_ext.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - attachment{}.file_extension_type + - attachment{}.sha256 + - destination{}.service + - num_message_attachments + - payload_size + - subject + - destination{}.address + - source.address + security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: suspicious email from $source.address$ to $destination{}.address$ + observable: + - name: source.address + type: User + role: + - attacker + - name: destination{}.address + type: User + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.yml b/detections/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.yml new file mode 100644 index 0000000000..b01bb0baec --- /dev/null +++ b/detections/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.yml @@ -0,0 +1,63 @@ +name: Gsuite Outbound Email With Attachment To External Domain +id: dc4dc3a8-ff54-11eb-8bf7-acde48001122 +version: 1 +date: '2021-08-17' +author: Teoderick Contreras, Stanislav Miskovic, Splunk +type: Anomaly +datamodel: +- Endpoint +- Email +description: This search is to detect a suspicious outbound e-mail from internal email to external email domain. + This can be a good hunting query to monitor insider or outbound email traffic for not common domain e-mail. + The idea is to parse the domain of destination email check if there is a minimum outbound traffic < 20 with attachment. +search: '`gsuite_gmail` num_message_attachments > 0 + | rex field=source.from_header_address "[^@]+@(?[^@]+)" + | rex field=destination{}.address "[^@]+@(?[^@]+)" + | where source_domain="internal_test_email.com" and not dest_domain="internal_test_email.com" + | stats values(subject) as subject, values(source.from_header_address) as src_domain_list, count as numEvents, dc(source.from_header_address) as numSrcAddresses, + min(_time) as firstTime max(_time) as lastTime by dest_domain + | where numSrcAddresses < 20 |sort - numSrcAddresses + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `gsuite_outbound_email_with_attachment_to_external_domain_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs related to gsuite having the file attachment metadata like file type, file + extension, source email, destination email, num of attachment and etc. +known_false_positives: network admin and normal user may send this file attachment as part of their day to day work. having a good protocol + in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack. +references: +- https://www.redhat.com/en/topics/devops/what-is-devsecops +tags: + analytic_story: + - DevSecOps + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_outbound_email_to_external/gsuite_external_domain.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1048.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: 30 + confidence: 30 + # (impact * confidence)/100 + risk_score: 9 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: suspicious email from $source.address$ to $destination{}.address$ + observable: + - name: source.address + type: User + role: + - attacker + - name: destination{}.address + type: User + role: + - Victim + \ No newline at end of file diff --git a/macros/gsuite_drive.yml b/macros/gsuite_drive.yml new file mode 100644 index 0000000000..6c00f68a75 --- /dev/null +++ b/macros/gsuite_drive.yml @@ -0,0 +1,5 @@ +definition: sourcetype=gsuite:drive:json +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: gsuite_drive + diff --git a/macros/gsuite_gmail.yml b/macros/gsuite_gmail.yml new file mode 100644 index 0000000000..21ed20bfc4 --- /dev/null +++ b/macros/gsuite_gmail.yml @@ -0,0 +1,4 @@ +definition: sourcetype=gsuite:gmail:bigquery +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: gsuite_gmail \ No newline at end of file diff --git a/tests/endpoint/gsuite_drive_share_in_external_email.test.yml b/tests/endpoint/gsuite_drive_share_in_external_email.test.yml new file mode 100644 index 0000000000..7e2af359b6 --- /dev/null +++ b/tests/endpoint/gsuite_drive_share_in_external_email.test.yml @@ -0,0 +1,12 @@ +name: Gsuite Drive Share In External Email Unit Test +tests: +- name: Gsuite Drive Share In External Email + file: endpoint/gsuite_drive_share_in_external_email.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: gdrive_share_external.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1567.002/gsuite_share_drive/gdrive_share_external.log + source: http:gsuite + sourcetype: gsuite:drive:json \ No newline at end of file diff --git a/tests/endpoint/gsuite_email_suspicious_attachment.test.yml b/tests/endpoint/gsuite_email_suspicious_attachment.test.yml new file mode 100644 index 0000000000..309b876695 --- /dev/null +++ b/tests/endpoint/gsuite_email_suspicious_attachment.test.yml @@ -0,0 +1,12 @@ +name: GSuite Email Suspicious Attachment Unit Test +tests: +- name: GSuite Email Suspicious Attachment + file: endpoint/gsuite_email_suspicious_attachment.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: gsuite_gmail_file_ext.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_attachment_ext/gsuite_gmail_file_ext.log + source: http:gsuite + sourcetype: gsuite:gmail:bigquery \ No newline at end of file diff --git a/tests/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.test.yml b/tests/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.test.yml new file mode 100644 index 0000000000..59d3226b7d --- /dev/null +++ b/tests/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.test.yml @@ -0,0 +1,12 @@ +name: Gsuite Outbound Email With Attachment To External Domain Unit Test +tests: +- name: Gsuite Outbound Email With Attachment To External Domain + file: endpoint/gsuite_outbound_email_with_attachment_to_external_domain.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: gsuite_external_domain.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_outbound_email_to_external/gsuite_external_domain.log + source: http:gsuite + sourcetype: gsuite:gmail:bigquery \ No newline at end of file