From bd65f1b2c116ec3d9daf24fb91a9ad261c34cf0a Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 16 Aug 2021 15:05:15 +0200 Subject: [PATCH 1/7] dev_ops_uc --- .../gsuite_email_suspicious_attachment.yml | 47 +++++++++++++++++++ ...suite_email_suspicious_attachment.test.yml | 12 +++++ 2 files changed, 59 insertions(+) create mode 100644 detections/endpoint/gsuite_email_suspicious_attachment.yml create mode 100644 tests/endpoint/gsuite_email_suspicious_attachment.test.yml diff --git a/detections/endpoint/gsuite_email_suspicious_attachment.yml b/detections/endpoint/gsuite_email_suspicious_attachment.yml new file mode 100644 index 0000000000..627c41779c --- /dev/null +++ b/detections/endpoint/gsuite_email_suspicious_attachment.yml @@ -0,0 +1,47 @@ +name: GSuite Email Suspicious Attachment +id: 6d663014-fe92-11eb-ab07-acde48001122 +version: 1 +date: '2021-08-16' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious attachment file extension in Gsuite email that may related to spear phishing attack. + This file type is commonly used by malware to lure user to click on it to execute malicious code to compromised targetted machine. + But this search can also catch some normal files related to this file type that maybe send by employee or network admin. + +search: 'index=obs-gsuite sourcetype="gsuite:gmail:bigquery" tcontreras "attachment{}.file_extension_type" + IN ("pl", "py", "rb", "sh", "bat", "exe", "dll", "cpl", "com", "js", "vbs", "ps1", "reg","swf", "cmd", "go") + | stats count min(_time) as firstTime max(_time) as lastTime by attachment{}.file_extension_type attachment{}.sha256 + destination{}.service num_message_attachments payload_size subject destination{}.address source.address + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `gsuite_suspicious_attachment_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. +known_false_positives: network admin and normal user may send this file attachment as part of their day to day work. having a good protocol + in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack. +references: +tags: + analytic_story: + - UPDATE_STORY_NAME + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + message: + observable: \ No newline at end of file diff --git a/tests/endpoint/gsuite_email_suspicious_attachment.test.yml b/tests/endpoint/gsuite_email_suspicious_attachment.test.yml new file mode 100644 index 0000000000..17f2f9a384 --- /dev/null +++ b/tests/endpoint/gsuite_email_suspicious_attachment.test.yml @@ -0,0 +1,12 @@ +name: GSuite Email Suspicious Attachment Unit Test +tests: +- name: GSuite Email Suspicious Attachment + file: detections/endpoint/gsuite_email_suspicious_attachment.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file From 2ff22d36e685a55d177a99e9b1113d1e622783a4 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 16 Aug 2021 16:54:54 +0200 Subject: [PATCH 2/7] dev_ops_uc --- .../gsuite_drive_share_in_external_email.yml | 45 +++++++++++++++++++ .../gsuite_email_suspicious_attachment.yml | 5 ++- ...ite_drive_share_in_external_email.test.yml | 12 +++++ 3 files changed, 60 insertions(+), 2 deletions(-) create mode 100644 detections/endpoint/gsuite_drive_share_in_external_email.yml create mode 100644 tests/endpoint/gsuite_drive_share_in_external_email.test.yml diff --git a/detections/endpoint/gsuite_drive_share_in_external_email.yml b/detections/endpoint/gsuite_drive_share_in_external_email.yml new file mode 100644 index 0000000000..afdaf4dad5 --- /dev/null +++ b/detections/endpoint/gsuite_drive_share_in_external_email.yml @@ -0,0 +1,45 @@ +name: Gsuite Drive Share In External Email +id: f6ee02d6-fea0-11eb-b2c2-acde48001122 +version: 1 +date: '2021-08-16' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect suspicious google drive or google docs files shared outside or externally. + This behavior might be a good hunting query to monitor exfitration of data made by an attacker to a compromise machine. +search: 'index=obs-gsuite sourcetype=gsuite:drive:json NOT(email IN ("*splunk.com", "null")) + | stats values(parameters.doc_title) as doc_title count min(_time) as firstTime max(_time) as lastTime by + parameters.doc_type parameters.owner email + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `gsuite_drive_share_in_external_email_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs related to gsuite having the file attachment metadata like file type, file + extension, source email, destination email, num of attachment and etc. +known_false_positives: network admin or normal user may share files to customer and external team. +references: +tags: + analytic_story: + - UPDATE_STORY_NAME + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Exfiltration + mitre_attack_id: + - T1003.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: 30 + confidence: 30 + # (impact * confidence)/100 + risk_score: 9 + context: + message: + observable: + \ No newline at end of file diff --git a/detections/endpoint/gsuite_email_suspicious_attachment.yml b/detections/endpoint/gsuite_email_suspicious_attachment.yml index 627c41779c..8b8b3ad0d3 100644 --- a/detections/endpoint/gsuite_email_suspicious_attachment.yml +++ b/detections/endpoint/gsuite_email_suspicious_attachment.yml @@ -10,7 +10,7 @@ description: This search is to detect a suspicious attachment file extension in This file type is commonly used by malware to lure user to click on it to execute malicious code to compromised targetted machine. But this search can also catch some normal files related to this file type that maybe send by employee or network admin. -search: 'index=obs-gsuite sourcetype="gsuite:gmail:bigquery" tcontreras "attachment{}.file_extension_type" +search: 'index=obs-gsuite sourcetype="gsuite:gmail:bigquery" "attachment{}.file_extension_type" IN ("pl", "py", "rb", "sh", "bat", "exe", "dll", "cpl", "com", "js", "vbs", "ps1", "reg","swf", "cmd", "go") | stats count min(_time) as firstTime max(_time) as lastTime by attachment{}.file_extension_type attachment{}.sha256 destination{}.service num_message_attachments payload_size subject destination{}.address source.address @@ -18,7 +18,8 @@ search: 'index=obs-gsuite sourcetype="gsuite:gmail:bigquery" tcontreras "attachm | `security_content_ctime(lastTime)` | `gsuite_suspicious_attachment_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. + logs related to gsuite having the file attachment metadata like file type, file + extension, source email, destination email, num of attachment and etc. known_false_positives: network admin and normal user may send this file attachment as part of their day to day work. having a good protocol in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack. references: diff --git a/tests/endpoint/gsuite_drive_share_in_external_email.test.yml b/tests/endpoint/gsuite_drive_share_in_external_email.test.yml new file mode 100644 index 0000000000..74bc625b31 --- /dev/null +++ b/tests/endpoint/gsuite_drive_share_in_external_email.test.yml @@ -0,0 +1,12 @@ +name: Gsuite Drive Share In External Email Unit Test +tests: +- name: Gsuite Drive Share In External Email + file: detections/endpoint/gsuite_drive_share_in_external_email.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file From a3da84e2ffd1552ffcc443aa3ad47e5f5cb43a55 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 17 Aug 2021 15:18:49 +0200 Subject: [PATCH 3/7] dev_ops_uc --- .../gsuite_drive_share_in_external_email.yml | 10 ++-- ...ail_with_attachment_to_external_domain.yml | 49 +++++++++++++++++++ ...ith_attachment_to_external_domain.test.yml | 12 +++++ 3 files changed, 67 insertions(+), 4 deletions(-) create mode 100644 detections/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.yml create mode 100644 tests/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.test.yml diff --git a/detections/endpoint/gsuite_drive_share_in_external_email.yml b/detections/endpoint/gsuite_drive_share_in_external_email.yml index afdaf4dad5..e69126645d 100644 --- a/detections/endpoint/gsuite_drive_share_in_external_email.yml +++ b/detections/endpoint/gsuite_drive_share_in_external_email.yml @@ -7,10 +7,12 @@ type: batch datamodel: - Endpoint description: This search is to detect suspicious google drive or google docs files shared outside or externally. - This behavior might be a good hunting query to monitor exfitration of data made by an attacker to a compromise machine. -search: 'index=obs-gsuite sourcetype=gsuite:drive:json NOT(email IN ("*splunk.com", "null")) - | stats values(parameters.doc_title) as doc_title count min(_time) as firstTime max(_time) as lastTime by - parameters.doc_type parameters.owner email + This behavior might be a good hunting query to monitor exfitration of data made by an attacker or insider to a targetted machine. +search: 'index=obs-gsuite sourcetype=gsuite:drive:json NOT (email IN("", "null")) + | rex field=parameters.owner "[^@]+@(?[^@]+)" + | rex field=email "[^@]+@(?[^@]+)" + | where src_domain = "splunk.com" and not dest_domain = "splunk.com" + | stats values(parameters.doc_title) as doc_title, values(parameters.doc_type) as doc_types, values(email) as dst_email_list, values(parameters.visibility) as visibility, count min(_time) as firstTime max(_time) as lastTime by parameters.owner | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gsuite_drive_share_in_external_email_filter`' diff --git a/detections/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.yml b/detections/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.yml new file mode 100644 index 0000000000..a83457ff63 --- /dev/null +++ b/detections/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.yml @@ -0,0 +1,49 @@ +name: Gsuite Outbound Email With Attachment To External Domain +id: dc4dc3a8-ff54-11eb-8bf7-acde48001122 +version: 1 +date: '2021-08-17' +author: Teoderick Contreras, Stanislav Miskovic, Splunk +type: batch +datamodel: +- Endpoint +- Email +description: This search is to detect a suspicious outbound e-mail from internal email to external email domain. + This can be a good hunting query to monitor insider or outbound email traffic for not common domain e-mail. + The idea is to parse the domain of destination email check if there is a minimum outbound traffic < 20 with attachment. +search: 'index=obs-gsuite sourcetype="gsuite:gmail:bigquery" num_message_attachments > 0 + | rex field=source.from_header_address "[^@]+@(?[^@]+)" + | rex field=destination{}.address "[^@]+@(?[^@]+)" + | where source_domain="splunk.com" and not dest_domain="splunk.com" + | stats values(subject) as subject, values(source.from_header_address) as src_domain_list, count as numEvents, dc(source.from_header_address) as numSrcAddresses by dest_domain + | where numSrcAddresses < 20 |sort - numSrcAddresses + | `gsuite_outbound_email_with_attachment_to_external_domain_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs related to gsuite having the file attachment metadata like file type, file + extension, source email, destination email, num of attachment and etc. +known_false_positives: network admin and normal user may send this file attachment as part of their day to day work. having a good protocol + in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack. +references: +tags: + analytic_story: + - UPDATE_STORY_NAME + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1003.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: 30 + confidence: 30 + # (impact * confidence)/100 + risk_score: 9 + context: + message: + observable: + \ No newline at end of file diff --git a/tests/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.test.yml b/tests/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.test.yml new file mode 100644 index 0000000000..1840817f1d --- /dev/null +++ b/tests/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.test.yml @@ -0,0 +1,12 @@ +name: Gsuite Outbound Email With Attachment To External Domain Unit Test +tests: +- name: Gsuite Outbound Email With Attachment To External Domain + file: detections/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file From 1bde88fc3f9991ee658987bf8c9ef5403a934341 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 18 Aug 2021 15:58:35 +0200 Subject: [PATCH 4/7] dev_ops_uc --- .../gsuite_drive_share_in_external_email.yml | 32 +++++++++++++---- .../gsuite_email_suspicious_attachment.yml | 36 ++++++++++++++----- ...ail_with_attachment_to_external_domain.yml | 28 +++++++++++---- macros/gsuite_drive.yml | 5 +++ macros/gsuite_gmail.yml | 4 +++ ...ite_drive_share_in_external_email.test.yml | 6 ++-- 6 files changed, 85 insertions(+), 26 deletions(-) create mode 100644 macros/gsuite_drive.yml create mode 100644 macros/gsuite_gmail.yml diff --git a/detections/endpoint/gsuite_drive_share_in_external_email.yml b/detections/endpoint/gsuite_drive_share_in_external_email.yml index e69126645d..bac4bf0a7d 100644 --- a/detections/endpoint/gsuite_drive_share_in_external_email.yml +++ b/detections/endpoint/gsuite_drive_share_in_external_email.yml @@ -3,45 +3,63 @@ id: f6ee02d6-fea0-11eb-b2c2-acde48001122 version: 1 date: '2021-08-16' author: Teoderick Contreras, Splunk -type: batch +type: Anomaly datamodel: - Endpoint description: This search is to detect suspicious google drive or google docs files shared outside or externally. This behavior might be a good hunting query to monitor exfitration of data made by an attacker or insider to a targetted machine. -search: 'index=obs-gsuite sourcetype=gsuite:drive:json NOT (email IN("", "null")) +search: '`gsuite_drive` NOT (email IN("", "null")) | rex field=parameters.owner "[^@]+@(?[^@]+)" | rex field=email "[^@]+@(?[^@]+)" - | where src_domain = "splunk.com" and not dest_domain = "splunk.com" + | where src_domain = "internal_test_email.com" and not dest_domain = "internal_test_email.com" | stats values(parameters.doc_title) as doc_title, values(parameters.doc_type) as doc_types, values(email) as dst_email_list, values(parameters.visibility) as visibility, count min(_time) as firstTime max(_time) as lastTime by parameters.owner | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + | `security_content_ctime(lastTime)` | `gsuite_drive_share_in_external_email_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. known_false_positives: network admin or normal user may share files to customer and external team. references: +- https://www.redhat.com/en/topics/devops/what-is-devsecops tags: analytic_story: - - UPDATE_STORY_NAME + - DevSecOps dataset: - UPDATE_DATASET_URL kill_chain_phases: - Exfiltration mitre_attack_id: - - T1003.002 + - T1567.002 product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud required_fields: - _time + - parameters.doc_title + - src_domain + - dest_domain + - email + - parameters.visibility + - parameters.owner + - parameters.doc_type security_domain: endpoint impact: 30 confidence: 30 # (impact * confidence)/100 risk_score: 9 context: - message: + - Source:Endpoint + - Stage:Reconnaissance + message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$ observable: + - name: parameters.owner + type: User + role: + - attacker + - name: email + type: User + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/gsuite_email_suspicious_attachment.yml b/detections/endpoint/gsuite_email_suspicious_attachment.yml index 8b8b3ad0d3..f1b48b86de 100644 --- a/detections/endpoint/gsuite_email_suspicious_attachment.yml +++ b/detections/endpoint/gsuite_email_suspicious_attachment.yml @@ -3,19 +3,18 @@ id: 6d663014-fe92-11eb-ab07-acde48001122 version: 1 date: '2021-08-16' author: Teoderick Contreras, Splunk -type: batch +type: Anomaly datamodel: - Endpoint description: This search is to detect a suspicious attachment file extension in Gsuite email that may related to spear phishing attack. This file type is commonly used by malware to lure user to click on it to execute malicious code to compromised targetted machine. But this search can also catch some normal files related to this file type that maybe send by employee or network admin. -search: 'index=obs-gsuite sourcetype="gsuite:gmail:bigquery" "attachment{}.file_extension_type" - IN ("pl", "py", "rb", "sh", "bat", "exe", "dll", "cpl", "com", "js", "vbs", "ps1", "reg","swf", "cmd", "go") - | stats count min(_time) as firstTime max(_time) as lastTime by attachment{}.file_extension_type attachment{}.sha256 - destination{}.service num_message_attachments payload_size subject destination{}.address source.address +search: '`gsuite_gmail` "attachment{}.file_extension_type" IN ("pl", "py", "rb", "sh", "bat", "exe", "dll", "cpl", "com", "js", "vbs", "ps1", "reg","swf", "cmd", "go") + | stats count min(_time) as firstTime max(_time) as lastTime values(attachment{}.file_extension_type) as email_attachments, values(attachment{}.sha256) as attachment_sha256, values(payload_size) as payload_size by + destination{}.service num_message_attachments subject destination{}.address source.address | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + | `security_content_ctime(lastTime)` | `gsuite_suspicious_attachment_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file @@ -23,9 +22,10 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: network admin and normal user may send this file attachment as part of their day to day work. having a good protocol in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack. references: +- https://www.redhat.com/en/topics/devops/what-is-devsecops tags: analytic_story: - - UPDATE_STORY_NAME + - DevSecOps dataset: - UPDATE_DATASET_URL kill_chain_phases: @@ -38,11 +38,29 @@ tags: - Splunk Cloud required_fields: - _time + - attachment{}.file_extension_type + - attachment{}.sha256 + - destination{}.service + - num_message_attachments + - payload_size + - subject + - destination{}.address + - source.address security_domain: endpoint impact: 70 confidence: 70 # (impact * confidence)/100 risk_score: 49 context: - message: - observable: \ No newline at end of file + - Source:Endpoint + - Stage:Reconnaissance + message: suspicious email from $source.address$ to $destination{}.address$ + observable: + - name: source.address + type: User + role: + - attacker + - name: destination{}.address + type: User + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.yml b/detections/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.yml index a83457ff63..294063412d 100644 --- a/detections/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.yml +++ b/detections/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.yml @@ -3,19 +3,22 @@ id: dc4dc3a8-ff54-11eb-8bf7-acde48001122 version: 1 date: '2021-08-17' author: Teoderick Contreras, Stanislav Miskovic, Splunk -type: batch +type: Anomaly datamodel: - Endpoint - Email description: This search is to detect a suspicious outbound e-mail from internal email to external email domain. This can be a good hunting query to monitor insider or outbound email traffic for not common domain e-mail. The idea is to parse the domain of destination email check if there is a minimum outbound traffic < 20 with attachment. -search: 'index=obs-gsuite sourcetype="gsuite:gmail:bigquery" num_message_attachments > 0 +search: '`gsuite_gmail` num_message_attachments > 0 | rex field=source.from_header_address "[^@]+@(?[^@]+)" | rex field=destination{}.address "[^@]+@(?[^@]+)" - | where source_domain="splunk.com" and not dest_domain="splunk.com" - | stats values(subject) as subject, values(source.from_header_address) as src_domain_list, count as numEvents, dc(source.from_header_address) as numSrcAddresses by dest_domain + | where source_domain="internal_test_email.com" and not dest_domain="internal_test_email.com" + | stats values(subject) as subject, values(source.from_header_address) as src_domain_list, count as numEvents, dc(source.from_header_address) as numSrcAddresses, + min(_time) as firstTime max(_time) as lastTime by dest_domain | where numSrcAddresses < 20 |sort - numSrcAddresses + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `gsuite_outbound_email_with_attachment_to_external_domain_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file @@ -23,15 +26,16 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: network admin and normal user may send this file attachment as part of their day to day work. having a good protocol in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack. references: +- https://www.redhat.com/en/topics/devops/what-is-devsecops tags: analytic_story: - - UPDATE_STORY_NAME + - DevSecOps dataset: - UPDATE_DATASET_URL kill_chain_phases: - Exploitation mitre_attack_id: - - T1003.002 + - T1048.003 product: - Splunk Enterprise - Splunk Enterprise Security @@ -44,6 +48,16 @@ tags: # (impact * confidence)/100 risk_score: 9 context: - message: + - Source:Endpoint + - Stage:Reconnaissance + message: suspicious email from $source.address$ to $destination{}.address$ observable: + - name: source.address + type: User + role: + - attacker + - name: destination{}.address + type: User + role: + - Victim \ No newline at end of file diff --git a/macros/gsuite_drive.yml b/macros/gsuite_drive.yml new file mode 100644 index 0000000000..6c00f68a75 --- /dev/null +++ b/macros/gsuite_drive.yml @@ -0,0 +1,5 @@ +definition: sourcetype=gsuite:drive:json +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: gsuite_drive + diff --git a/macros/gsuite_gmail.yml b/macros/gsuite_gmail.yml new file mode 100644 index 0000000000..21ed20bfc4 --- /dev/null +++ b/macros/gsuite_gmail.yml @@ -0,0 +1,4 @@ +definition: sourcetype=gsuite:gmail:bigquery +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: gsuite_gmail \ No newline at end of file diff --git a/tests/endpoint/gsuite_drive_share_in_external_email.test.yml b/tests/endpoint/gsuite_drive_share_in_external_email.test.yml index 74bc625b31..025c172935 100644 --- a/tests/endpoint/gsuite_drive_share_in_external_email.test.yml +++ b/tests/endpoint/gsuite_drive_share_in_external_email.test.yml @@ -1,12 +1,12 @@ name: Gsuite Drive Share In External Email Unit Test tests: - name: Gsuite Drive Share In External Email - file: detections/endpoint/gsuite_drive_share_in_external_email.yml + file: endpoint/gsuite_drive_share_in_external_email.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL + - file_name: gdrive_share_external.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1567.002/gsuite_share_drive/gdrive_share_external.log source: UPDATE_SPLUNK_SOURCE sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file From 5c8bd617be64af0cc6c53ec6a9541841d41e1e86 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 19 Aug 2021 12:03:28 +0200 Subject: [PATCH 5/7] dev_ops_uc --- detections/endpoint/gsuite_drive_share_in_external_email.yml | 2 +- detections/endpoint/gsuite_email_suspicious_attachment.yml | 2 +- ...uite_outbound_email_with_attachment_to_external_domain.yml | 2 +- tests/endpoint/gsuite_drive_share_in_external_email.test.yml | 4 ++-- tests/endpoint/gsuite_email_suspicious_attachment.test.yml | 4 ++-- ...outbound_email_with_attachment_to_external_domain.test.yml | 4 ++-- 6 files changed, 9 insertions(+), 9 deletions(-) diff --git a/detections/endpoint/gsuite_drive_share_in_external_email.yml b/detections/endpoint/gsuite_drive_share_in_external_email.yml index bac4bf0a7d..124f44d239 100644 --- a/detections/endpoint/gsuite_drive_share_in_external_email.yml +++ b/detections/endpoint/gsuite_drive_share_in_external_email.yml @@ -26,7 +26,7 @@ tags: analytic_story: - DevSecOps dataset: - - UPDATE_DATASET_URL + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1567.002/gsuite_share_drive/gdrive_share_external.log kill_chain_phases: - Exfiltration mitre_attack_id: diff --git a/detections/endpoint/gsuite_email_suspicious_attachment.yml b/detections/endpoint/gsuite_email_suspicious_attachment.yml index f1b48b86de..6271b98ec8 100644 --- a/detections/endpoint/gsuite_email_suspicious_attachment.yml +++ b/detections/endpoint/gsuite_email_suspicious_attachment.yml @@ -27,7 +27,7 @@ tags: analytic_story: - DevSecOps dataset: - - UPDATE_DATASET_URL + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_attachment_ext/gsuite_gmail_file_ext.log kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.yml b/detections/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.yml index 294063412d..b01bb0baec 100644 --- a/detections/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.yml +++ b/detections/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.yml @@ -31,7 +31,7 @@ tags: analytic_story: - DevSecOps dataset: - - UPDATE_DATASET_URL + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_outbound_email_to_external/gsuite_external_domain.log kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/tests/endpoint/gsuite_drive_share_in_external_email.test.yml b/tests/endpoint/gsuite_drive_share_in_external_email.test.yml index 025c172935..7e2af359b6 100644 --- a/tests/endpoint/gsuite_drive_share_in_external_email.test.yml +++ b/tests/endpoint/gsuite_drive_share_in_external_email.test.yml @@ -8,5 +8,5 @@ tests: attack_data: - file_name: gdrive_share_external.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1567.002/gsuite_share_drive/gdrive_share_external.log - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + source: http:gsuite + sourcetype: gsuite:drive:json \ No newline at end of file diff --git a/tests/endpoint/gsuite_email_suspicious_attachment.test.yml b/tests/endpoint/gsuite_email_suspicious_attachment.test.yml index 17f2f9a384..9a25f2ed68 100644 --- a/tests/endpoint/gsuite_email_suspicious_attachment.test.yml +++ b/tests/endpoint/gsuite_email_suspicious_attachment.test.yml @@ -8,5 +8,5 @@ tests: attack_data: - file_name: UPDATE_FILE_NAME data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + source: http:gsuite + sourcetype: gsuite:gmail:bigquery \ No newline at end of file diff --git a/tests/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.test.yml b/tests/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.test.yml index 1840817f1d..a5f8af71d1 100644 --- a/tests/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.test.yml +++ b/tests/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.test.yml @@ -8,5 +8,5 @@ tests: attack_data: - file_name: UPDATE_FILE_NAME data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + source: http:gsuite + sourcetype: gsuite:gmail:bigquery \ No newline at end of file From ceb9c848a29a4be291225ede75226829b4634ea4 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 19 Aug 2021 12:05:53 +0200 Subject: [PATCH 6/7] dev_ops_uc --- tests/endpoint/gsuite_email_suspicious_attachment.test.yml | 6 +++--- ...tbound_email_with_attachment_to_external_domain.test.yml | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/tests/endpoint/gsuite_email_suspicious_attachment.test.yml b/tests/endpoint/gsuite_email_suspicious_attachment.test.yml index 9a25f2ed68..309b876695 100644 --- a/tests/endpoint/gsuite_email_suspicious_attachment.test.yml +++ b/tests/endpoint/gsuite_email_suspicious_attachment.test.yml @@ -1,12 +1,12 @@ name: GSuite Email Suspicious Attachment Unit Test tests: - name: GSuite Email Suspicious Attachment - file: detections/endpoint/gsuite_email_suspicious_attachment.yml + file: endpoint/gsuite_email_suspicious_attachment.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL + - file_name: gsuite_gmail_file_ext.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_attachment_ext/gsuite_gmail_file_ext.log source: http:gsuite sourcetype: gsuite:gmail:bigquery \ No newline at end of file diff --git a/tests/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.test.yml b/tests/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.test.yml index a5f8af71d1..59d3226b7d 100644 --- a/tests/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.test.yml +++ b/tests/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.test.yml @@ -1,12 +1,12 @@ name: Gsuite Outbound Email With Attachment To External Domain Unit Test tests: - name: Gsuite Outbound Email With Attachment To External Domain - file: detections/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.yml + file: endpoint/gsuite_outbound_email_with_attachment_to_external_domain.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL + - file_name: gsuite_external_domain.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_outbound_email_to_external/gsuite_external_domain.log source: http:gsuite sourcetype: gsuite:gmail:bigquery \ No newline at end of file From c7b6dfd9f34edb6cbf400a711333f40f0c20e50b Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 19 Aug 2021 12:08:22 +0200 Subject: [PATCH 7/7] dev_ops_uc --- detections/endpoint/gsuite_email_suspicious_attachment.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/gsuite_email_suspicious_attachment.yml b/detections/endpoint/gsuite_email_suspicious_attachment.yml index 6271b98ec8..672cb53919 100644 --- a/detections/endpoint/gsuite_email_suspicious_attachment.yml +++ b/detections/endpoint/gsuite_email_suspicious_attachment.yml @@ -15,7 +15,7 @@ search: '`gsuite_gmail` "attachment{}.file_extension_type" IN ("pl", "py", "rb", destination{}.service num_message_attachments subject destination{}.address source.address | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `gsuite_suspicious_attachment_filter`' + | `gsuite_email_suspicious_attachment_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.