admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

refineddescriptions

Browse Source
This commit is contained in:
Rod Soto
2021-08-24 12:01:20 -07:00
parent 6198477ada
commit a7e131fdcc
2 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/gdrive_suspicious_file_sharing.yml
+1 -1
View File
@@ -9,7 +9,7 @@ datamodel:
- Email
- Updates
description: This search can help the detection of compromised accounts or internal users sending malicious documents via GSuite file sharing.
search: 'sourcetype="gsuite:drive:json" parameters.target_user=* name=change_user_access parameters.target_user > 100 | spath "parameters.owner" | search "parameters.owner"="*" | stats count by src_ip parameters.owner parameters.target_user parameters.doc_type parameters.doc_title | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
search: 'sourcetype="gsuite:drive:json" name=change_user_access parameters.target_user > 100 | spath "parameters.owner" | search "parameters.owner"="*" | stats count by src_ip parameters.owner parameters.target_user parameters.doc_type parameters.doc_title | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
| `gdrive_suspicious_file_sharing_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs related to gsuite (gsuite:drive:json) having the file sharing metadata like file type, source owner, destination target user, description, etc.
detections/cloud/gsuite_suspicious_calendar_invite.yml
+4 -4
View File
@@ -10,12 +10,12 @@ datamodel:
- Updates
description: This search can help the detection of compromised accounts or internal users sending suspcious calendar invites via GSuite calendar. These
invites may contain malicious links or attachments.
search: 'sourcetype="gsuite:calendar:json" email=* parameters.event_title!=null parameters.target_calendar_id > 100 | stats count by email ip_address source name parameters.api_kind parameters.event_title parameters.organizer_calendar_id parameters.target_calendar_id parameters.user_agent parameters.event_response_status | convert timeformat="%Y-%m-%dT%H:%M:%S" ctime(firstTime)
search: 'sourcetype="gsuite:calendar:json" email=* parameters.event_title!=null parameters.target_calendar_id > 100 | stats count by email ip_address source name parameters.api_kind parameters.event_title parameters.organizer_calendar_id parameters.target_calendar_id parameters.event_response_status | convert timeformat="%Y-%m-%dT%H:%M:%S" ctime(firstTime)
| convert timeformat="%Y-%m-%dT%H:%M:%S" ctime(lastTime)| `gsuite_suspicious_calendar_invite_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs related to gsuite (gsuite:drive:json) having the file sharing metadata like file type, source owner, destination target user, description, etc.
how_to_implement: To successfully implement this search, you need to be ingesting logs related to gsuite (gsuite:drive:json) having the file sharing metadata like file type, source owner, destination target user, description, etc. This search can also be made more specific by selecting specific emails, subdomains
timeframe, organizational units, targeted user, etc.
known_false_positives: This search will also produce normal activity statistics. Fields such as email, ip address, name, parameters.organizer_calendar_id, parameters.target_calendar_id and parameters.event_title may give away
phishing intent.
phishing intent.For more specific results use email parameter,
references:
- https://www.techrepublic.com/article/how-to-avoid-the-dreaded-google-calendar-malicious-invite-issue/
tags: