admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

dev_sec2

Browse Source
This commit is contained in:
tccontre
2021-08-23 13:18:57 +02:00
parent 9a0227affd
commit 64ef47d844
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/gsuite_suspicious_shared_file_name.yml
+1 -1
View File
@@ -10,7 +10,7 @@ datamodel:
description: This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign.
This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website.
This detection can also catch some normal email communication between organization and its external customer.
search: 'index=obs-gsuite sourcetype=gsuite:drive:json parameters.owner_is_team_drive=false "parameters.doc_title" IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") parameters.doc_type IN ("document","pdf", "msexcel", "msword", "spreadsheet", "presentation")
search: '`gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_title" IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") parameters.doc_type IN ("document","pdf", "msexcel", "msword", "spreadsheet", "presentation")
| rex field=parameters.owner "[^@]+@(?<source_domain>[^@]+)"
| rex field=parameters.target_user "[^@]+@(?<dest_domain>[^@]+)"
| where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com"