Branch was auto-updated.

automated_detection_testing/detection_service.py

@@ -148,7 +148,7 @@ def main(args):
                     detection_obj['tags']['dataset'] = datasets
 
                 with open(file_path, 'w') as f:
-                    yaml.dump(detection_obj, f, sort_keys=False)
+                    yaml.dump(detection_obj, f, sort_keys=False, allow_unicode=True)
 
                 changed_file_path = 'detections/' + test['detection_result']['detection_file']
                 security_content_repo_obj.index.add([changed_file_path])
@@ -177,7 +177,7 @@ def main(args):
 
 
 def load_file(file_path):
-    with open(file_path, 'r') as stream:
+    with open(file_path, 'r', encoding="utf-8") as stream:
         try:
             file = list(yaml.safe_load_all(stream))[0]
         except yaml.YAMLError as exc:

detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml

@@ -0,0 +1,68 @@
+name: Gsuite Email Suspicious Subject With Attachment
+id: 8ef3971e-00f2-11ec-b54f-acde48001122
+version: 1
+date: '2021-08-19'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel: []
+description: This search is to detect a gsuite email contains suspicious subject having
+  known file type used in spear phishing. This technique is a common and effective
+  entry vector of attacker to compromise a network by luring the user to click or
+  execute the suspicious attachment send from external email account because of the
+  effective social engineering of subject related to delivery, bank and so on. On
+  the other hand this detection may catch a normal email traffic related to legitimate
+  transaction so better to check the email sender, spelling and etc. avoid click link
+  or opening the attachment if you are not expecting this type of e-mail.
+search: '`gsuite_gmail` num_message_attachments > 0 subject IN ("*dhl*", "* ups *",
+  "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "* fedex *", "* usps
+  *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") attachment{}.file_extension_type
+  IN ("doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "zip", "rar", "html","htm","hta")
+  | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)" | rex field=destination{}.address
+  "[^@]+@(?<dest_domain>[^@]+)" | where not source_domain="internal_test_email.com"
+  and dest_domain="internal_test_email.com" | stats count min(_time) as firstTime
+  max(_time) as lastTime values(attachment{}.file_extension_type) as email_attachments,
+  values(attachment{}.sha256) as attachment_sha256, values(payload_size) as payload_size
+  by destination{}.service num_message_attachments  subject destination{}.address
+  source.address | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `gsuite_email_suspicious_subject_with_attachment_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs related to gsuite having the file attachment metadata like file type, file
+  extension, source email, destination email, num of attachment and etc.
+known_false_positives: normal user or normal transaction may contain the subject and
+  file type attachment that this detection try to search.
+references:
+- https://www.redhat.com/en/topics/devops/what-is-devsecops
+- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf
+tags:
+  analytic_story:
+  - DevSecOps
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_subj/gsuite_susp_subj_attach.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1566.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Reconnaissance
+  message: suspicious email from $source.address$ to $destination{}.address$
+  observable:
+  - name: source.address
+    type: User
+    role:
+    - attacker
+  - name: destination{}.address
+    type: User
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml

@@ -0,0 +1,58 @@
+name: Gsuite Email With Known Abuse Web Service Link
+id: 8630aa22-042b-11ec-af39-acde48001122
+version: 1
+date: '2021-08-23'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel: []
+description: This analytics is to detect a gmail containing a link that are known
+  to be abused by malware or attacker like pastebin, telegram and discord to deliver
+  malicious payload. This event can encounter some normal email traffic within organization
+  and external email that normally using this application and services.
+search: '`gsuite_gmail` "link_domain{}" IN ("*pastebin.com*", "*discord*", "*telegram*","t.me")
+  | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)" | rex field=destination{}.address
+  "[^@]+@(?<dest_domain>[^@]+)" | where not source_domain="internal_test_email.com"
+  and dest_domain="internal_test_email.com" |stats values(link_domain{}) as link_domains
+  min(_time) as firstTime max(_time) as lastTime count by is_spam source.address source.from_header_address
+  subject destination{}.address | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `gsuite_email_with_known_abuse_web_service_link_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs related to gsuite having the file attachment metadata like file type, file
+  extension, source email, destination email, num of attachment and etc.
+known_false_positives: normal email contains this link that are known application
+  within the organization or network can be catched by this detection.
+references:
+- https://news.sophos.com/en-us/2021/07/22/malware-increasingly-targets-discord-for-abuse/
+tags:
+  analytic_story:
+  - DevSecOps
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_url/gsuite_susp_url.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1566.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Reconnaissance
+  message: suspicious email from $source.address$ to $destination{}.address$
+  observable:
+  - name: source.address
+    type: User
+    role:
+    - attacker
+  - name: destination{}.address
+    type: User
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/cloud/gsuite_suspicious_shared_file_name.yml

@@ -0,0 +1,71 @@
+name: Gsuite Suspicious Shared File Name
+id: 07eed200-03f5-11ec-98fb-acde48001122
+version: 1
+date: '2021-08-23'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel: []
+description: This search is to detect a shared file in google drive with suspicious
+  file name that are commonly used by spear phishing campaign. This technique is very
+  popular to lure the user by running a malicious document or click a malicious link
+  within the shared file that will redirected to malicious website. This detection
+  can also catch some normal email communication between organization and its external
+  customer.
+search: '`gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_title"
+  IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*",
+  "*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*",
+  "*new order*") parameters.doc_type IN ("document","pdf", "msexcel", "msword", "spreadsheet",
+  "presentation") | rex field=parameters.owner "[^@]+@(?<source_domain>[^@]+)" | rex
+  field=parameters.target_user "[^@]+@(?<dest_domain>[^@]+)" | where not source_domain="internal_test_email.com"
+  and dest_domain="internal_test_email.com" | stats count min(_time) as firstTime
+  max(_time) as lastTime by email parameters.owner parameters.target_user parameters.doc_title
+  parameters.doc_type | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `gsuite_suspicious_shared_file_name_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs related to gsuite having the file attachment metadata like file type, file
+  extension, source email, destination email, num of attachment and etc.
+known_false_positives: normal user or normal transaction may contain the subject and
+  file type attachment that this detection try to search
+references:
+- https://www.redhat.com/en/topics/devops/what-is-devsecops
+- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf
+tags:
+  analytic_story:
+  - DevSecOps
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gdrive_susp_file_share/gdrive_susp_attach.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1566.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - parameters.doc_title
+  - src_domain
+  - dest_domain
+  - email
+  - parameters.visibility
+  - parameters.owner
+  - parameters.doc_type
+  security_domain: endpoint
+  impact: 30
+  confidence: 30
+  risk_score: 9
+  context:
+  - Source:Endpoint
+  - Stage:Reconnaissance
+  message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$
+  observable:
+  - name: parameters.owner
+    type: User
+    role:
+    - attacker
+  - name: email
+    type: User
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml

@@ -80,3 +80,4 @@ tags:
   - Processes.parent_process_id
   risk_score: 90
   security_domain: endpoint
+

tests/cloud/gsuite_email_suspicious_subject_with_attachment.test.yml

@@ -0,0 +1,12 @@
+name: Gsuite Email Suspicious Subject With Attachment Unit Test
+tests:
+- name: Gsuite Email Suspicious Subject With Attachment
+  file: cloud/gsuite_email_suspicious_subject_with_attachment.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: gsuite_susp_subj_attach.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_subj/gsuite_susp_subj_attach.log
+    source: http:gsuite
+    sourcetype: gsuite:gmail:bigquery

tests/cloud/gsuite_email_with_known_abuse_web_service_link.test.yml

@@ -0,0 +1,12 @@
+name: Gsuite Email With Known Abuse Web Service Link Unit Test
+tests:
+- name: Gsuite Email With Known Abuse Web Service Link
+  file: cloud/gsuite_email_with_known_abuse_web_service_link.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: gsuite_susp_url.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_url/gsuite_susp_url.log
+    source: http:gsuite
+    sourcetype: gsuite:gmail:bigquery

tests/cloud/gsuite_suspicious_shared_file_name.test.yml

@@ -0,0 +1,12 @@
+name: Gsuite Suspicious Shared File Name Unit Test
+tests:
+- name: Gsuite Suspicious Shared File Name
+  file: cloud/gsuite_suspicious_shared_file_name.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: gdrive_susp_attach.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gdrive_susp_file_share/gdrive_susp_attach.log
+    source: http:gsuite
+    sourcetype: gsuite:drive:json