Delete gsuite_email_with_known_abuse_web_service_link.yml

detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml

@@ -1,57 +0,0 @@
-name: Gsuite Email With Known Abuse Web Service Link
-id: 8630aa22-042b-11ec-af39-acde48001122
-version: 1
-date: '2021-08-23'
-author: Teoderick Contreras, Splunk
-type: Anomaly
-datamodel: []
-description: This search is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. 
-  This event can encounter some normal email traffic within organization and external email that normally using this application and services.
-search: '`gsuite_gmail` "link_domain{}" IN ("*pastebin.com*", "*discord*", "*telegram*","t.me") 
-| rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)"  
-  | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)"  
-   | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" 
-  |stats values(link_domain{}) as link_domains min(_time) as firstTime max(_time) as lastTime count by is_spam source.address source.from_header_address subject destination{}.address
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `gsuite_email_with_known_abuse_web_service_link_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs related to gsuite having the file attachment metadata like file type, file 
-  extension, source email, destination email, num of attachment and etc.
-known_false_positives: normal email contains this link that are known application within the organization or network can be catched by this detection.
-references:
-- https://news.sophos.com/en-us/2021/07/22/malware-increasingly-targets-discord-for-abuse/
-tags:
-  analytic_story:
-  - DevSecOps
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_url/gsuite_susp_url.log
-  kill_chain_phases:
-  - Exploitation
-  mitre_attack_id:
-  - T1566.001
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  security_domain: endpoint
-  impact: 50
-  confidence: 50
-  # (impact * confidence)/100
-  risk_score: 25
-  context:
-  - Source:Endpoint
-  - Stage:Reconnaissance
-  message: suspicious email from $source.address$ to $destination{}.address$
-  observable:
-  - name: source.address
-    type: User
-    role:
-    - attacker
-  - name: destination{}.address 
-    type: User
-    role:
-    - Victim
-