dev_ops_uc

detections/endpoint/gsuite_drive_share_in_external_email.yml

@@ -7,10 +7,12 @@ type: batch
 datamodel:
 - Endpoint
 description: This search is to detect suspicious google drive or google docs files shared outside or externally. 
-  This behavior might be a good hunting query to monitor exfitration of data made by an attacker to a compromise machine.
-search: 'index=obs-gsuite sourcetype=gsuite:drive:json NOT(email IN ("*splunk.com", "null"))
-  | stats values(parameters.doc_title) as doc_title count min(_time) as firstTime max(_time) as lastTime by 
-  parameters.doc_type parameters.owner email 
+  This behavior might be a good hunting query to monitor exfitration of data made by an attacker or insider to a targetted machine.
+search: 'index=obs-gsuite sourcetype=gsuite:drive:json NOT (email IN("", "null")) 
+  | rex field=parameters.owner "[^@]+@(?<src_domain>[^@]+)"  
+  | rex field=email "[^@]+@(?<dest_domain>[^@]+)"
+  | where src_domain = "splunk.com" and not dest_domain = "splunk.com" 
+  | stats values(parameters.doc_title) as doc_title, values(parameters.doc_type) as doc_types, values(email) as dst_email_list, values(parameters.visibility) as visibility, count min(_time) as firstTime max(_time) as lastTime by parameters.owner
   | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` 
   | `gsuite_drive_share_in_external_email_filter`'

detections/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.yml

@@ -0,0 +1,49 @@
+name: Gsuite Outbound Email With Attachment To External Domain
+id: dc4dc3a8-ff54-11eb-8bf7-acde48001122
+version: 1
+date: '2021-08-17'
+author: Teoderick Contreras, Stanislav Miskovic, Splunk
+type: batch
+datamodel:
+- Endpoint
+- Email
+description: This search is to detect a suspicious outbound e-mail from internal email to external email domain. 
+  This can be a good hunting query to monitor insider or outbound email traffic for not common domain e-mail.
+  The idea is to parse the domain of destination email check if there is a minimum outbound traffic < 20 with attachment.
+search: 'index=obs-gsuite sourcetype="gsuite:gmail:bigquery" num_message_attachments > 0 
+  | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)"  
+  | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)"  
+  | where source_domain="splunk.com" and not dest_domain="splunk.com" 
+  | stats values(subject) as subject, values(source.from_header_address) as src_domain_list, count as numEvents, dc(source.from_header_address) as numSrcAddresses  by dest_domain  
+  | where numSrcAddresses < 20 |sort - numSrcAddresses
+  | `gsuite_outbound_email_with_attachment_to_external_domain_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs related to gsuite having the file attachment metadata like file type, file 
+  extension, source email, destination email, num of attachment and etc.
+known_false_positives: network admin and normal user may send this file attachment as part of their day to day work. having a good protocol 
+  in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack.
+references:
+tags:
+  analytic_story:
+  - UPDATE_STORY_NAME
+  dataset:
+  - UPDATE_DATASET_URL
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1003.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 30
+  confidence: 30
+  # (impact * confidence)/100
+  risk_score: 9
+  context:
+  message: 
+  observable:
+  

tests/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.test.yml

@@ -0,0 +1,12 @@
+name: Gsuite Outbound Email With Attachment To External Domain Unit Test
+tests:
+- name: Gsuite Outbound Email With Attachment To External Domain
+  file: detections/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: UPDATE_FILE_NAME
+    data: UPDATE_DATASET_URL
+    source: UPDATE_SPLUNK_SOURCE
+    sourcetype: UPDATE_SPLUNK_SOURCETYPE