From 64ef47d844deb20350ec831688a7eaff71a9f461 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 23 Aug 2021 13:18:57 +0200 Subject: [PATCH] dev_sec2 --- detections/endpoint/gsuite_suspicious_shared_file_name.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/gsuite_suspicious_shared_file_name.yml b/detections/endpoint/gsuite_suspicious_shared_file_name.yml index 87f2ecbb87..dda923e569 100644 --- a/detections/endpoint/gsuite_suspicious_shared_file_name.yml +++ b/detections/endpoint/gsuite_suspicious_shared_file_name.yml @@ -10,7 +10,7 @@ datamodel: description: This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website. This detection can also catch some normal email communication between organization and its external customer. -search: 'index=obs-gsuite sourcetype=gsuite:drive:json parameters.owner_is_team_drive=false "parameters.doc_title" IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") parameters.doc_type IN ("document","pdf", "msexcel", "msword", "spreadsheet", "presentation") +search: '`gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_title" IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") parameters.doc_type IN ("document","pdf", "msexcel", "msword", "spreadsheet", "presentation") | rex field=parameters.owner "[^@]+@(?[^@]+)" | rex field=parameters.target_user "[^@]+@(?[^@]+)" | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com"