dev_sec2

detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml

@@ -4,10 +4,7 @@ version: 1
 date: '2021-08-19'
 author: Teoderick Contreras, Splunk
 type: Anomaly
-datamodel:
-- Endpoint
-- Email
-- Updates
+datamodel: []
 description: This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing.
   This technique is a common and effective entry vector of attacker to compromise a network by luring the user to click or execute the suspicious attachment 
   send from external email account because of the effective social engineering of subject related to delivery, bank and so on.

detections/cloud/gsuite_suspicious_shared_file_name.yml

@@ -4,9 +4,7 @@ version: 1
 date: '2021-08-23'
 author: Teoderick Contreras, Splunk
 type: Anomaly
-datamodel:
-- Endpoint
-- Email
+datamodel: []
 description: This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. 
   This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website.
   This detection can also catch some normal email communication between organization and its external customer.

tests/cloud/gsuite_email_suspicious_subject_with_attachment.test.yml

@@ -1,7 +1,7 @@
 name: Gsuite Email Suspicious Subject With Attachment Unit Test
 tests:
 - name: Gsuite Email Suspicious Subject With Attachment
-  file: endpoint/gsuite_email_suspicious_subject_with_attachment.yml
+  file: cloud/gsuite_email_suspicious_subject_with_attachment.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'

tests/cloud/gsuite_suspicious_shared_file_name.test.yml

@@ -1,7 +1,7 @@
 name: Gsuite Suspicious Shared File Name Unit Test
 tests:
 - name: Gsuite Suspicious Shared File Name
-  file: endpoint/gsuite_suspicious_shared_file_name.yml
+  file: cloud/gsuite_suspicious_shared_file_name.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'