From a7f7f0b090d37f0cac4613ffc9a8296fbc044815 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Thu, 19 Aug 2021 15:45:36 +0200
Subject: [PATCH 01/16] dev_sec2

---
 ...ail_suspicious_subject_with_attachment.yml | 64 +++++++++++++++++++
 ...uspicious_subject_with_attachment.test.yml | 12 ++++
 2 files changed, 76 insertions(+)
 create mode 100644 detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml
 create mode 100644 tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml

diff --git a/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml b/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml
new file mode 100644
index 0000000000..830034e639
--- /dev/null
+++ b/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml
@@ -0,0 +1,64 @@
+name: Gsuite Email Suspicious Subject With Attachment
+id: 8ef3971e-00f2-11ec-b54f-acde48001122
+version: 1
+date: '2021-08-19'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+- Email
+- Updates
+description: This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing.
+  This technique is really a very common and effective entry vector of attacker to compromise a network by clicking or running the suspicous attachment 
+  send from external email account. 
+search: '`gsuite_gmail` num_message_attachments > 0  
+  subject IN ("*dhl*", "* ups *”, “*delivery*”, “*parcel*”, “*label*”, “*invoice*”, “*postal*”, “* fedex *”, “* usps *”, “* express *”, “*shipment*”, “*Banking/Tax*”,”*shipment*”, “*new order*”) 
+  attachment{}.file_extension_type IN ("doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "zip", "rar”, “html”,”htm”,”hta”) 
+  | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)"  
+  | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)"  
+  | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" 
+  | stats count min(_time) as firstTime max(_time) as lastTime values(attachment{}.file_extension_type) as email_attachments, values(attachment{}.sha256) as attachment_sha256, values(payload_size) as payload_size by   
+  destination{}.service num_message_attachments  subject destination{}.address source.address
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `gsuite_email_suspicious_subject_with_attachment_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs related to gsuite having the file attachment metadata like file type, file 
+  extension, source email, destination email, num of attachment and etc.
+known_false_positives: normal user or normal transaction may contain the subject and file type attachment that 
+  this detection try to search.
+references:
+- https://www.redhat.com/en/topics/devops/what-is-devsecops
+tags:
+  analytic_story:
+  - DevSecOps
+  dataset:
+  - UPDATE_DATASET_URL
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1566.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  # (impact * confidence)/100
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Reconnaissance
+  message: suspicious email from $source.address$ to $destination{}.address$
+  observable:
+  - name: source.address
+    type: User
+    role:
+    - attacker
+  - name: destination{}.address 
+    type: User
+    role:
+    - Victim
\ No newline at end of file
diff --git a/tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml b/tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml
new file mode 100644
index 0000000000..0e535c5fae
--- /dev/null
+++ b/tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml
@@ -0,0 +1,12 @@
+name: Gsuite Email Suspicious Subject With Attachment Unit Test
+tests:
+- name: Gsuite Email Suspicious Subject With Attachment
+  file: detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: UPDATE_FILE_NAME
+    data: UPDATE_DATASET_URL
+    source: UPDATE_SPLUNK_SOURCE
+    sourcetype: UPDATE_SPLUNK_SOURCETYPE
\ No newline at end of file

From ea29a11c37154013506c12a8576ce0f7ac98cb8e Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Fri, 20 Aug 2021 10:40:33 +0200
Subject: [PATCH 02/16] dev_sec2

---
 ...gsuite_email_suspicious_subject_with_attachment.yml |  8 +++++---
 ...e_email_suspicious_subject_with_attachment.test.yml | 10 +++++-----
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml b/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml
index 830034e639..99ca5cfd98 100644
--- a/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml
+++ b/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml
@@ -9,8 +9,10 @@ datamodel:
 - Email
 - Updates
 description: This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing.
-  This technique is really a very common and effective entry vector of attacker to compromise a network by clicking or running the suspicous attachment 
-  send from external email account. 
+  This technique is a common and effective entry vector of attacker to compromise a network by luring the user to click or execute the suspicious attachment 
+  send from external email account because of the effective social engineering of subject related to delivery, bank and so on.
+  On the other hand this detection may catch a normal email traffic related to legitimate transaction so better to check the email sender, spelling and etc.
+  avoid click link or opening the attachment if you are not expecting this type of e-mail. 
 search: '`gsuite_gmail` num_message_attachments > 0  
   subject IN ("*dhl*", "* ups *”, “*delivery*”, “*parcel*”, “*label*”, “*invoice*”, “*postal*”, “* fedex *”, “* usps *”, “* express *”, “*shipment*”, “*Banking/Tax*”,”*shipment*”, “*new order*”) 
   attachment{}.file_extension_type IN ("doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "zip", "rar”, “html”,”htm”,”hta”) 
@@ -33,7 +35,7 @@ tags:
   analytic_story:
   - DevSecOps
   dataset:
-  - UPDATE_DATASET_URL
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1566.001/gsuite_susp_subj/gsuite_susp_subj_attach.log
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
diff --git a/tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml b/tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml
index 0e535c5fae..c3cb0a32c8 100644
--- a/tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml
+++ b/tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml
@@ -1,12 +1,12 @@
 name: Gsuite Email Suspicious Subject With Attachment Unit Test
 tests:
 - name: Gsuite Email Suspicious Subject With Attachment
-  file: detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml
+  file: endpoint/gsuite_email_suspicious_subject_with_attachment.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
   attack_data:
-  - file_name: UPDATE_FILE_NAME
-    data: UPDATE_DATASET_URL
-    source: UPDATE_SPLUNK_SOURCE
-    sourcetype: UPDATE_SPLUNK_SOURCETYPE
\ No newline at end of file
+  - file_name: gsuite_susp_subj_attach.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_subj/gsuite_susp_subj_attach.log
+    source: http:gsuite
+    sourcetype: gsuite:gmail:bigquery
\ No newline at end of file

From ccede9d326d0467b1344619c9fe132d7e878d057 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Mon, 23 Aug 2021 13:13:53 +0200
Subject: [PATCH 03/16] dev_sec2

---
 ...ail_suspicious_subject_with_attachment.yml |  1 +
 .../gsuite_suspicious_shared_file_name.yml    | 69 +++++++++++++++++++
 ...suite_suspicious_shared_file_name.test.yml | 12 ++++
 3 files changed, 82 insertions(+)
 create mode 100644 detections/endpoint/gsuite_suspicious_shared_file_name.yml
 create mode 100644 tests/endpoint/gsuite_suspicious_shared_file_name.test.yml

diff --git a/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml b/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml
index 99ca5cfd98..566f03c8a9 100644
--- a/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml
+++ b/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml
@@ -31,6 +31,7 @@ known_false_positives: normal user or normal transaction may contain the subject
   this detection try to search.
 references:
 - https://www.redhat.com/en/topics/devops/what-is-devsecops
+- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf
 tags:
   analytic_story:
   - DevSecOps
diff --git a/detections/endpoint/gsuite_suspicious_shared_file_name.yml b/detections/endpoint/gsuite_suspicious_shared_file_name.yml
new file mode 100644
index 0000000000..f078dbcbeb
--- /dev/null
+++ b/detections/endpoint/gsuite_suspicious_shared_file_name.yml
@@ -0,0 +1,69 @@
+name: Gsuite Suspicious Shared File Name
+id: 07eed200-03f5-11ec-98fb-acde48001122
+version: 1
+date: '2021-08-23'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+- Email
+description: This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. 
+  This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website.
+  This detection can also catch some normal email communication between organization and its external customer.
+search: 'index=obs-gsuite sourcetype=gsuite:drive:json parameters.owner_is_team_drive=false "parameters.doc_title" IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") parameters.doc_type IN ("document","pdf", "msexcel", "msword", "spreadsheet", "presentation")
+  | rex field=parameters.owner "[^@]+@(?<source_domain>[^@]+)"  
+  | rex field=parameters.target_user "[^@]+@(?<dest_domain>[^@]+)"  
+  | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" 
+  | stats count min(_time) as firstTime max(_time) as lastTime by email parameters.owner parameters.target_user parameters.doc_title parameters.doc_type
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `gsuite_suspicious_shared_file_name_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs related to gsuite having the file attachment metadata like file type, file 
+  extension, source email, destination email, num of attachment and etc.
+known_false_positives: normal user or normal transaction may contain the subject and file type attachment that 
+  this detection try to search
+references:
+- https://www.redhat.com/en/topics/devops/what-is-devsecops
+- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf
+tags:
+  analytic_story:
+  - DevSecOps
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gdrive_susp_file_share/gdrive_susp_attach.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1566.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - parameters.doc_title
+  - src_domain
+  - dest_domain
+  - email
+  - parameters.visibility
+  - parameters.owner
+  - parameters.doc_type
+  security_domain: endpoint
+  impact: 30
+  confidence: 30
+  # (impact * confidence)/100
+  risk_score: 9
+  context:
+  - Source:Endpoint
+  - Stage:Reconnaissance
+  message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$
+  observable:
+  - name: parameters.owner
+    type: User
+    role:
+    - attacker
+  - name: email
+    type: User
+    role:
+    - Victim
+  
\ No newline at end of file
diff --git a/tests/endpoint/gsuite_suspicious_shared_file_name.test.yml b/tests/endpoint/gsuite_suspicious_shared_file_name.test.yml
new file mode 100644
index 0000000000..a59374a794
--- /dev/null
+++ b/tests/endpoint/gsuite_suspicious_shared_file_name.test.yml
@@ -0,0 +1,12 @@
+name: Gsuite Suspicious Shared File Name Unit Test
+tests:
+- name: Gsuite Suspicious Shared File Name
+  file: endpoint/gsuite_suspicious_shared_file_name.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: gdrive_susp_attach.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gdrive_susp_file_share/gdrive_susp_attach.log
+    source: http:gsuite
+    sourcetype: gsuite:drive:json 
\ No newline at end of file

From e16bc9a3b8b944f33355b43094b452b96bd5056e Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Mon, 23 Aug 2021 13:16:30 +0200
Subject: [PATCH 04/16] dev_sec2

---
 detections/endpoint/gsuite_suspicious_shared_file_name.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/gsuite_suspicious_shared_file_name.yml b/detections/endpoint/gsuite_suspicious_shared_file_name.yml
index f078dbcbeb..87f2ecbb87 100644
--- a/detections/endpoint/gsuite_suspicious_shared_file_name.yml
+++ b/detections/endpoint/gsuite_suspicious_shared_file_name.yml
@@ -3,7 +3,7 @@ id: 07eed200-03f5-11ec-98fb-acde48001122
 version: 1
 date: '2021-08-23'
 author: Teoderick Contreras, Splunk
-type: batch
+type: Anomaly
 datamodel:
 - Endpoint
 - Email

From 1e95e7a0e1afc0b996783f51802cabc5fa40cf43 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Mon, 23 Aug 2021 13:18:57 +0200
Subject: [PATCH 05/16] dev_sec2

---
 detections/endpoint/gsuite_suspicious_shared_file_name.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/gsuite_suspicious_shared_file_name.yml b/detections/endpoint/gsuite_suspicious_shared_file_name.yml
index 87f2ecbb87..dda923e569 100644
--- a/detections/endpoint/gsuite_suspicious_shared_file_name.yml
+++ b/detections/endpoint/gsuite_suspicious_shared_file_name.yml
@@ -10,7 +10,7 @@ datamodel:
 description: This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. 
   This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website.
   This detection can also catch some normal email communication between organization and its external customer.
-search: 'index=obs-gsuite sourcetype=gsuite:drive:json parameters.owner_is_team_drive=false "parameters.doc_title" IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") parameters.doc_type IN ("document","pdf", "msexcel", "msword", "spreadsheet", "presentation")
+search: '`gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_title" IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") parameters.doc_type IN ("document","pdf", "msexcel", "msword", "spreadsheet", "presentation")
   | rex field=parameters.owner "[^@]+@(?<source_domain>[^@]+)"  
   | rex field=parameters.target_user "[^@]+@(?<dest_domain>[^@]+)"  
   | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" 

From 7c8f1416b62cda9ad8f8f315f853d11d0ed58a07 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Mon, 23 Aug 2021 17:30:20 +0200
Subject: [PATCH 06/16] dev_sec2

---
 .../gsuite_email_suspicious_subject_with_attachment.yml      | 5 +----
 .../gsuite_suspicious_shared_file_name.yml                   | 4 +---
 .../gsuite_email_suspicious_subject_with_attachment.test.yml | 2 +-
 .../gsuite_suspicious_shared_file_name.test.yml              | 2 +-
 4 files changed, 4 insertions(+), 9 deletions(-)
 rename detections/{endpoint => cloud}/gsuite_email_suspicious_subject_with_attachment.yml (98%)
 rename detections/{endpoint => cloud}/gsuite_suspicious_shared_file_name.yml (98%)
 rename tests/{endpoint => cloud}/gsuite_email_suspicious_subject_with_attachment.test.yml (87%)
 rename tests/{endpoint => cloud}/gsuite_suspicious_shared_file_name.test.yml (89%)

diff --git a/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml
similarity index 98%
rename from detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml
rename to detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml
index 566f03c8a9..cba0a58be3 100644
--- a/detections/endpoint/gsuite_email_suspicious_subject_with_attachment.yml
+++ b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml
@@ -4,10 +4,7 @@ version: 1
 date: '2021-08-19'
 author: Teoderick Contreras, Splunk
 type: Anomaly
-datamodel:
-- Endpoint
-- Email
-- Updates
+datamodel: []
 description: This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing.
   This technique is a common and effective entry vector of attacker to compromise a network by luring the user to click or execute the suspicious attachment 
   send from external email account because of the effective social engineering of subject related to delivery, bank and so on.
diff --git a/detections/endpoint/gsuite_suspicious_shared_file_name.yml b/detections/cloud/gsuite_suspicious_shared_file_name.yml
similarity index 98%
rename from detections/endpoint/gsuite_suspicious_shared_file_name.yml
rename to detections/cloud/gsuite_suspicious_shared_file_name.yml
index dda923e569..9b7bd30b24 100644
--- a/detections/endpoint/gsuite_suspicious_shared_file_name.yml
+++ b/detections/cloud/gsuite_suspicious_shared_file_name.yml
@@ -4,9 +4,7 @@ version: 1
 date: '2021-08-23'
 author: Teoderick Contreras, Splunk
 type: Anomaly
-datamodel:
-- Endpoint
-- Email
+datamodel: []
 description: This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. 
   This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website.
   This detection can also catch some normal email communication between organization and its external customer.
diff --git a/tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml b/tests/cloud/gsuite_email_suspicious_subject_with_attachment.test.yml
similarity index 87%
rename from tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml
rename to tests/cloud/gsuite_email_suspicious_subject_with_attachment.test.yml
index c3cb0a32c8..bd6e1a260c 100644
--- a/tests/endpoint/gsuite_email_suspicious_subject_with_attachment.test.yml
+++ b/tests/cloud/gsuite_email_suspicious_subject_with_attachment.test.yml
@@ -1,7 +1,7 @@
 name: Gsuite Email Suspicious Subject With Attachment Unit Test
 tests:
 - name: Gsuite Email Suspicious Subject With Attachment
-  file: endpoint/gsuite_email_suspicious_subject_with_attachment.yml
+  file: cloud/gsuite_email_suspicious_subject_with_attachment.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
diff --git a/tests/endpoint/gsuite_suspicious_shared_file_name.test.yml b/tests/cloud/gsuite_suspicious_shared_file_name.test.yml
similarity index 89%
rename from tests/endpoint/gsuite_suspicious_shared_file_name.test.yml
rename to tests/cloud/gsuite_suspicious_shared_file_name.test.yml
index a59374a794..70297baf7d 100644
--- a/tests/endpoint/gsuite_suspicious_shared_file_name.test.yml
+++ b/tests/cloud/gsuite_suspicious_shared_file_name.test.yml
@@ -1,7 +1,7 @@
 name: Gsuite Suspicious Shared File Name Unit Test
 tests:
 - name: Gsuite Suspicious Shared File Name
-  file: endpoint/gsuite_suspicious_shared_file_name.yml
+  file: cloud/gsuite_suspicious_shared_file_name.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'

From 211775854f4f562ed3a495ad88427bbf7084763f Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Mon, 23 Aug 2021 18:42:24 +0200
Subject: [PATCH 07/16] dev_sec2

---
 ...mail_with_known_abuse_web_service_link.yml | 57 +++++++++++++++++++
 ...with_known_abuse_web_service_link.test.yml | 12 ++++
 2 files changed, 69 insertions(+)
 create mode 100644 detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
 create mode 100644 tests/cloud/gsuite_email_with_known_abuse_web_service_link.test.yml

diff --git a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
new file mode 100644
index 0000000000..9c9e04c81b
--- /dev/null
+++ b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
@@ -0,0 +1,57 @@
+name: Gsuite Email With Known Abuse Web Service Link
+id: 8630aa22-042b-11ec-af39-acde48001122
+version: 1
+date: '2021-08-23'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel: []
+description: This search is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. 
+  This event can encounter some normal email traffic within organization and external email that normally using this application and services.
+search: '`gsuite_gmail` "link_domain{}" IN ("*pastebin.com*", "*discord*", "*telegram*","t.me") 
+| rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)"  
+  | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)"  
+   | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" 
+  |stats values(link_domain{}) as link_domains min(_time) as firstTime max(_time) as lastTime count by is_spam source.address source.from_header_address src_user subject destination{}.address
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `gsuite_email_with_known_abuse_web_service_link_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs related to gsuite having the file attachment metadata like file type, file 
+  extension, source email, destination email, num of attachment and etc.
+known_false_positives: normal email contains this link that are known application within the organization or network can be catched by this detection.
+references:
+- https://news.sophos.com/en-us/2021/07/22/malware-increasingly-targets-discord-for-abuse/
+tags:
+  analytic_story:
+  - DevSecOps
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_url/gsuite_susp_url.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1566.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  # (impact * confidence)/100
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Reconnaissance
+  message: suspicious email from $source.address$ to $destination{}.address$
+  observable:
+  - name: source.address
+    type: User
+    role:
+    - attacker
+  - name: destination{}.address 
+    type: User
+    role:
+    - Victim
+  
\ No newline at end of file
diff --git a/tests/cloud/gsuite_email_with_known_abuse_web_service_link.test.yml b/tests/cloud/gsuite_email_with_known_abuse_web_service_link.test.yml
new file mode 100644
index 0000000000..d8161f3f21
--- /dev/null
+++ b/tests/cloud/gsuite_email_with_known_abuse_web_service_link.test.yml
@@ -0,0 +1,12 @@
+name: Gsuite Email With Known Abuse Web Service Link Unit Test
+tests:
+- name: Gsuite Email With Known Abuse Web Service Link
+  file: cloud/gsuite_email_with_known_abuse_web_service_link.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: gsuite_susp_url.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_url/gsuite_susp_url.log
+    source: http:gsuite
+    sourcetype: gsuite:gmail:bigquery
\ No newline at end of file

From d831d8b84ae2f0a9cf454b0fbefdd684732a6a6e Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Mon, 23 Aug 2021 18:44:45 +0200
Subject: [PATCH 08/16] dev_sec2

---
 .../cloud/gsuite_email_with_known_abuse_web_service_link.yml    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
index 9c9e04c81b..c1c4f72ba8 100644
--- a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
+++ b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
@@ -3,7 +3,7 @@ id: 8630aa22-042b-11ec-af39-acde48001122
 version: 1
 date: '2021-08-23'
 author: Teoderick Contreras, Splunk
-type: batch
+type: Anomaly
 datamodel: []
 description: This search is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. 
   This event can encounter some normal email traffic within organization and external email that normally using this application and services.

From 90850700d2065bc05ab0b97aa757d7073b9c845b Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Mon, 23 Aug 2021 20:08:35 +0200
Subject: [PATCH 09/16] dev_sec2

---
 .../cloud/gsuite_email_with_known_abuse_web_service_link.yml    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
index c1c4f72ba8..440dbbf50b 100644
--- a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
+++ b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
@@ -11,7 +11,7 @@ search: '`gsuite_gmail` "link_domain{}" IN ("*pastebin.com*", "*discord*", "*tel
 | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)"  
   | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)"  
    | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" 
-  |stats values(link_domain{}) as link_domains min(_time) as firstTime max(_time) as lastTime count by is_spam source.address source.from_header_address src_user subject destination{}.address
+  |stats values(link_domain{}) as link_domains min(_time) as firstTime max(_time) as lastTime count by is_spam source.address source.from_header_address subject destination{}.address
   | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)`
   | `gsuite_email_with_known_abuse_web_service_link_filter`'

From 710609b4d6d5c9fe0b76a09224371322f9077e2c Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Thu, 26 Aug 2021 12:23:47 +0200
Subject: [PATCH 10/16] dev_sec2

---
 .../cloud/gsuite_email_with_known_abuse_web_service_link.yml    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
index 440dbbf50b..cf0bf78c3a 100644
--- a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
+++ b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
@@ -5,7 +5,7 @@ date: '2021-08-23'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel: []
-description: This search is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. 
+description: This analytics is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. 
   This event can encounter some normal email traffic within organization and external email that normally using this application and services.
 search: '`gsuite_gmail` "link_domain{}" IN ("*pastebin.com*", "*discord*", "*telegram*","t.me") 
 | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)"  

From d680c232b060d5edbc7137a612319c4e6d10c4e4 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-89-193>
Date: Fri, 27 Aug 2021 08:32:46 +0000
Subject: [PATCH 11/16] Added detection testing service results inGsuite Email
 With Known Abuse Web Service Link

---
 ...mail_with_known_abuse_web_service_link.yml | 29 ++++++++++---------
 1 file changed, 15 insertions(+), 14 deletions(-)

diff --git a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
index cf0bf78c3a..35957793cd 100644
--- a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
+++ b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
@@ -5,20 +5,22 @@ date: '2021-08-23'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel: []
-description: This analytics is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. 
-  This event can encounter some normal email traffic within organization and external email that normally using this application and services.
-search: '`gsuite_gmail` "link_domain{}" IN ("*pastebin.com*", "*discord*", "*telegram*","t.me") 
-| rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)"  
-  | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)"  
-   | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" 
-  |stats values(link_domain{}) as link_domains min(_time) as firstTime max(_time) as lastTime count by is_spam source.address source.from_header_address subject destination{}.address
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
+description: This analytics is to detect a gmail containing a link that are known
+  to be abused by malware or attacker like pastebin, telegram and discord to deliver
+  malicious payload. This event can encounter some normal email traffic within organization
+  and external email that normally using this application and services.
+search: '`gsuite_gmail` "link_domain{}" IN ("*pastebin.com*", "*discord*", "*telegram*","t.me")
+  | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)" | rex field=destination{}.address
+  "[^@]+@(?<dest_domain>[^@]+)" | where not source_domain="internal_test_email.com"
+  and dest_domain="internal_test_email.com" |stats values(link_domain{}) as link_domains
+  min(_time) as firstTime max(_time) as lastTime count by is_spam source.address source.from_header_address
+  subject destination{}.address | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `gsuite_email_with_known_abuse_web_service_link_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
-  logs related to gsuite having the file attachment metadata like file type, file 
+  logs related to gsuite having the file attachment metadata like file type, file
   extension, source email, destination email, num of attachment and etc.
-known_false_positives: normal email contains this link that are known application within the organization or network can be catched by this detection.
+known_false_positives: normal email contains this link that are known application
+  within the organization or network can be catched by this detection.
 references:
 - https://news.sophos.com/en-us/2021/07/22/malware-increasingly-targets-discord-for-abuse/
 tags:
@@ -39,7 +41,6 @@ tags:
   security_domain: endpoint
   impact: 50
   confidence: 50
-  # (impact * confidence)/100
   risk_score: 25
   context:
   - Source:Endpoint
@@ -50,8 +51,8 @@ tags:
     type: User
     role:
     - attacker
-  - name: destination{}.address 
+  - name: destination{}.address
     type: User
     role:
     - Victim
-  
\ No newline at end of file
+  automated_detection_testing: passed

From fd6d8378728b8561f1bb617b0468fbe34d3572fd Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-98-75>
Date: Fri, 27 Aug 2021 08:37:08 +0000
Subject: [PATCH 12/16] Added detection testing service results inGsuite
 Suspicious Shared File Name

---
 .../gsuite_suspicious_shared_file_name.yml    | 34 +++++++++++--------
 1 file changed, 19 insertions(+), 15 deletions(-)

diff --git a/detections/cloud/gsuite_suspicious_shared_file_name.yml b/detections/cloud/gsuite_suspicious_shared_file_name.yml
index 9b7bd30b24..dc8efaa7b0 100644
--- a/detections/cloud/gsuite_suspicious_shared_file_name.yml
+++ b/detections/cloud/gsuite_suspicious_shared_file_name.yml
@@ -5,22 +5,27 @@ date: '2021-08-23'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel: []
-description: This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. 
-  This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website.
-  This detection can also catch some normal email communication between organization and its external customer.
-search: '`gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_title" IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") parameters.doc_type IN ("document","pdf", "msexcel", "msword", "spreadsheet", "presentation")
-  | rex field=parameters.owner "[^@]+@(?<source_domain>[^@]+)"  
-  | rex field=parameters.target_user "[^@]+@(?<dest_domain>[^@]+)"  
-  | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" 
-  | stats count min(_time) as firstTime max(_time) as lastTime by email parameters.owner parameters.target_user parameters.doc_title parameters.doc_type
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
+description: This search is to detect a shared file in google drive with suspicious
+  file name that are commonly used by spear phishing campaign. This technique is very
+  popular to lure the user by running a malicious document or click a malicious link
+  within the shared file that will redirected to malicious website. This detection
+  can also catch some normal email communication between organization and its external
+  customer.
+search: '`gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_title"
+  IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*",
+  "*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*",
+  "*new order*") parameters.doc_type IN ("document","pdf", "msexcel", "msword", "spreadsheet",
+  "presentation") | rex field=parameters.owner "[^@]+@(?<source_domain>[^@]+)" | rex
+  field=parameters.target_user "[^@]+@(?<dest_domain>[^@]+)" | where not source_domain="internal_test_email.com"
+  and dest_domain="internal_test_email.com" | stats count min(_time) as firstTime
+  max(_time) as lastTime by email parameters.owner parameters.target_user parameters.doc_title
+  parameters.doc_type | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `gsuite_suspicious_shared_file_name_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
-  logs related to gsuite having the file attachment metadata like file type, file 
+  logs related to gsuite having the file attachment metadata like file type, file
   extension, source email, destination email, num of attachment and etc.
-known_false_positives: normal user or normal transaction may contain the subject and file type attachment that 
-  this detection try to search
+known_false_positives: normal user or normal transaction may contain the subject and
+  file type attachment that this detection try to search
 references:
 - https://www.redhat.com/en/topics/devops/what-is-devsecops
 - https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf
@@ -49,7 +54,6 @@ tags:
   security_domain: endpoint
   impact: 30
   confidence: 30
-  # (impact * confidence)/100
   risk_score: 9
   context:
   - Source:Endpoint
@@ -64,4 +68,4 @@ tags:
     type: User
     role:
     - Victim
-  
\ No newline at end of file
+  automated_detection_testing: passed

From 776ffd375ae61604a6b07a32d7602ee15b648399 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-173-232>
Date: Fri, 27 Aug 2021 09:55:45 +0000
Subject: [PATCH 13/16] Added detection testing service results inGsuite Email
 Suspicious Subject With Attachment

---
 ...ail_suspicious_subject_with_attachment.yml | 52 +++++++++++--------
 1 file changed, 29 insertions(+), 23 deletions(-)

diff --git a/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml
index cba0a58be3..f49c599634 100644
--- a/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml
+++ b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml
@@ -5,27 +5,33 @@ date: '2021-08-19'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel: []
-description: This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing.
-  This technique is a common and effective entry vector of attacker to compromise a network by luring the user to click or execute the suspicious attachment 
-  send from external email account because of the effective social engineering of subject related to delivery, bank and so on.
-  On the other hand this detection may catch a normal email traffic related to legitimate transaction so better to check the email sender, spelling and etc.
-  avoid click link or opening the attachment if you are not expecting this type of e-mail. 
-search: '`gsuite_gmail` num_message_attachments > 0  
-  subject IN ("*dhl*", "* ups *”, “*delivery*”, “*parcel*”, “*label*”, “*invoice*”, “*postal*”, “* fedex *”, “* usps *”, “* express *”, “*shipment*”, “*Banking/Tax*”,”*shipment*”, “*new order*”) 
-  attachment{}.file_extension_type IN ("doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "zip", "rar”, “html”,”htm”,”hta”) 
-  | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)"  
-  | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)"  
-  | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" 
-  | stats count min(_time) as firstTime max(_time) as lastTime values(attachment{}.file_extension_type) as email_attachments, values(attachment{}.sha256) as attachment_sha256, values(payload_size) as payload_size by   
-  destination{}.service num_message_attachments  subject destination{}.address source.address
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
-  | `gsuite_email_suspicious_subject_with_attachment_filter`'
+description: This search is to detect a gsuite email contains suspicious subject having
+  known file type used in spear phishing. This technique is a common and effective
+  entry vector of attacker to compromise a network by luring the user to click or
+  execute the suspicious attachment send from external email account because of the
+  effective social engineering of subject related to delivery, bank and so on. On
+  the other hand this detection may catch a normal email traffic related to legitimate
+  transaction so better to check the email sender, spelling and etc. avoid click link
+  or opening the attachment if you are not expecting this type of e-mail.
+search: "`gsuite_gmail` num_message_attachments > 0 subject IN (\"*dhl*\", \"* ups\
+  \ *\u201D, \u201C*delivery*\u201D, \u201C*parcel*\u201D, \u201C*label*\u201D, \u201C\
+  *invoice*\u201D, \u201C*postal*\u201D, \u201C* fedex *\u201D, \u201C* usps *\u201D\
+  , \u201C* express *\u201D, \u201C*shipment*\u201D, \u201C*Banking/Tax*\u201D,\u201D\
+  *shipment*\u201D, \u201C*new order*\u201D) attachment{}.file_extension_type IN (\"\
+  doc\", \"docx\", \"xls\", \"xlsx\", \"ppt\", \"pptx\", \"pdf\", \"zip\", \"rar\u201D\
+  , \u201Chtml\u201D,\u201Dhtm\u201D,\u201Dhta\u201D) | rex field=source.from_header_address\
+  \ \"[^@]+@(?<source_domain>[^@]+)\" | rex field=destination{}.address \"[^@]+@(?<dest_domain>[^@]+)\"\
+  \ | where not source_domain=\"internal_test_email.com\" and dest_domain=\"internal_test_email.com\"\
+  \ | stats count min(_time) as firstTime max(_time) as lastTime values(attachment{}.file_extension_type)\
+  \ as email_attachments, values(attachment{}.sha256) as attachment_sha256, values(payload_size)\
+  \ as payload_size by destination{}.service num_message_attachments  subject destination{}.address\
+  \ source.address | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`\
+  \ | `gsuite_email_suspicious_subject_with_attachment_filter`"
 how_to_implement: To successfully implement this search, you need to be ingesting
-  logs related to gsuite having the file attachment metadata like file type, file 
+  logs related to gsuite having the file attachment metadata like file type, file
   extension, source email, destination email, num of attachment and etc.
-known_false_positives: normal user or normal transaction may contain the subject and file type attachment that 
-  this detection try to search.
+known_false_positives: normal user or normal transaction may contain the subject and
+  file type attachment that this detection try to search.
 references:
 - https://www.redhat.com/en/topics/devops/what-is-devsecops
 - https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf
@@ -33,7 +39,7 @@ tags:
   analytic_story:
   - DevSecOps
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1566.001/gsuite_susp_subj/gsuite_susp_subj_attach.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_subj/gsuite_susp_subj_attach.log
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
@@ -47,7 +53,6 @@ tags:
   security_domain: endpoint
   impact: 50
   confidence: 50
-  # (impact * confidence)/100
   risk_score: 25
   context:
   - Source:Endpoint
@@ -58,7 +63,8 @@ tags:
     type: User
     role:
     - attacker
-  - name: destination{}.address 
+  - name: destination{}.address
     type: User
     role:
-    - Victim
\ No newline at end of file
+    - Victim
+  automated_detection_testing: passed

From 1ac0f6be2234a63a3f6854de473fca3e9b7d920f Mon Sep 17 00:00:00 2001
From: P4T12ICK <pbareiss@splunk.com>
Date: Fri, 27 Aug 2021 12:43:54 +0200
Subject: [PATCH 14/16] improve testing

---
 automated_detection_testing/detection_service.py              | 4 ++--
 .../attempted_credential_dump_from_registry_via_reg_exe.yml   | 1 +
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/automated_detection_testing/detection_service.py b/automated_detection_testing/detection_service.py
index 652f3a9d1e..022c2dadcd 100644
--- a/automated_detection_testing/detection_service.py
+++ b/automated_detection_testing/detection_service.py
@@ -148,7 +148,7 @@ def main(args):
                     detection_obj['tags']['dataset'] = datasets
 
                 with open(file_path, 'w') as f:
-                    yaml.dump(detection_obj, f, sort_keys=False)
+                    yaml.dump(detection_obj, f, sort_keys=False, allow_unicode=True)
 
                 changed_file_path = 'detections/' + test['detection_result']['detection_file']
                 security_content_repo_obj.index.add([changed_file_path])
@@ -177,7 +177,7 @@ def main(args):
 
 
 def load_file(file_path):
-    with open(file_path, 'r') as stream:
+    with open(file_path, 'r', encoding="utf-8") as stream:
         try:
             file = list(yaml.safe_load_all(stream))[0]
         except yaml.YAMLError as exc:
diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
index 619694db3c..f05fea3a44 100644
--- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
+++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
@@ -80,3 +80,4 @@ tags:
   - Processes.parent_process_id
   risk_score: 90
   security_domain: endpoint
+

From c78f8b16563c5c0f20868c68a065c70bd51fb0af Mon Sep 17 00:00:00 2001
From: P4T12ICK <pbareiss@splunk.com>
Date: Fri, 27 Aug 2021 12:44:56 +0200
Subject: [PATCH 15/16] changed detection

---
 ...ail_suspicious_subject_with_attachment.yml | 25 ++++++++-----------
 1 file changed, 11 insertions(+), 14 deletions(-)

diff --git a/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml
index f49c599634..e164d26f14 100644
--- a/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml
+++ b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml
@@ -13,20 +13,17 @@ description: This search is to detect a gsuite email contains suspicious subject
   the other hand this detection may catch a normal email traffic related to legitimate
   transaction so better to check the email sender, spelling and etc. avoid click link
   or opening the attachment if you are not expecting this type of e-mail.
-search: "`gsuite_gmail` num_message_attachments > 0 subject IN (\"*dhl*\", \"* ups\
-  \ *\u201D, \u201C*delivery*\u201D, \u201C*parcel*\u201D, \u201C*label*\u201D, \u201C\
-  *invoice*\u201D, \u201C*postal*\u201D, \u201C* fedex *\u201D, \u201C* usps *\u201D\
-  , \u201C* express *\u201D, \u201C*shipment*\u201D, \u201C*Banking/Tax*\u201D,\u201D\
-  *shipment*\u201D, \u201C*new order*\u201D) attachment{}.file_extension_type IN (\"\
-  doc\", \"docx\", \"xls\", \"xlsx\", \"ppt\", \"pptx\", \"pdf\", \"zip\", \"rar\u201D\
-  , \u201Chtml\u201D,\u201Dhtm\u201D,\u201Dhta\u201D) | rex field=source.from_header_address\
-  \ \"[^@]+@(?<source_domain>[^@]+)\" | rex field=destination{}.address \"[^@]+@(?<dest_domain>[^@]+)\"\
-  \ | where not source_domain=\"internal_test_email.com\" and dest_domain=\"internal_test_email.com\"\
-  \ | stats count min(_time) as firstTime max(_time) as lastTime values(attachment{}.file_extension_type)\
-  \ as email_attachments, values(attachment{}.sha256) as attachment_sha256, values(payload_size)\
-  \ as payload_size by destination{}.service num_message_attachments  subject destination{}.address\
-  \ source.address | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`\
-  \ | `gsuite_email_suspicious_subject_with_attachment_filter`"
+search: '`gsuite_gmail` num_message_attachments > 0  
+  subject IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "* fedex *", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") 
+  attachment{}.file_extension_type IN ("doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "zip", "rar", "html","htm","hta") 
+  | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)"  
+  | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)"  
+  | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" 
+  | stats count min(_time) as firstTime max(_time) as lastTime values(attachment{}.file_extension_type) as email_attachments, values(attachment{}.sha256) as attachment_sha256, values(payload_size) as payload_size by   
+  destination{}.service num_message_attachments  subject destination{}.address source.address
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `gsuite_email_suspicious_subject_with_attachment_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs related to gsuite having the file attachment metadata like file type, file
   extension, source email, destination email, num of attachment and etc.

From 3ac41ddb1af308009cb65ca07b582f4f9b259640 Mon Sep 17 00:00:00 2001
From: root <root@248d9ecc78d7>
Date: Fri, 27 Aug 2021 11:06:30 +0000
Subject: [PATCH 16/16] Added detection testing service results inGsuite Email
 Suspicious Subject With Attachment

---
 ...ail_suspicious_subject_with_attachment.yml | 21 ++++++++++---------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml
index e164d26f14..75f7b438c7 100644
--- a/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml
+++ b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml
@@ -13,16 +13,17 @@ description: This search is to detect a gsuite email contains suspicious subject
   the other hand this detection may catch a normal email traffic related to legitimate
   transaction so better to check the email sender, spelling and etc. avoid click link
   or opening the attachment if you are not expecting this type of e-mail.
-search: '`gsuite_gmail` num_message_attachments > 0  
-  subject IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "* fedex *", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") 
-  attachment{}.file_extension_type IN ("doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "zip", "rar", "html","htm","hta") 
-  | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)"  
-  | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)"  
-  | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" 
-  | stats count min(_time) as firstTime max(_time) as lastTime values(attachment{}.file_extension_type) as email_attachments, values(attachment{}.sha256) as attachment_sha256, values(payload_size) as payload_size by   
-  destination{}.service num_message_attachments  subject destination{}.address source.address
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
+search: '`gsuite_gmail` num_message_attachments > 0 subject IN ("*dhl*", "* ups *",
+  "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "* fedex *", "* usps
+  *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") attachment{}.file_extension_type
+  IN ("doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "zip", "rar", "html","htm","hta")
+  | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)" | rex field=destination{}.address
+  "[^@]+@(?<dest_domain>[^@]+)" | where not source_domain="internal_test_email.com"
+  and dest_domain="internal_test_email.com" | stats count min(_time) as firstTime
+  max(_time) as lastTime values(attachment{}.file_extension_type) as email_attachments,
+  values(attachment{}.sha256) as attachment_sha256, values(payload_size) as payload_size
+  by destination{}.service num_message_attachments  subject destination{}.address
+  source.address | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `gsuite_email_suspicious_subject_with_attachment_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs related to gsuite having the file attachment metadata like file type, file