diff --git a/detections/endpoint/gsuite_drive_share_in_external_email.yml b/detections/cloud/gsuite_drive_share_in_external_email.yml similarity index 99% rename from detections/endpoint/gsuite_drive_share_in_external_email.yml rename to detections/cloud/gsuite_drive_share_in_external_email.yml index 432f1d81b2..22fb3c998d 100644 --- a/detections/endpoint/gsuite_drive_share_in_external_email.yml +++ b/detections/cloud/gsuite_drive_share_in_external_email.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-08-16' author: Teoderick Contreras, Splunk type: Anomaly -datamodel: -- Endpoint +datamodel: [] description: This search is to detect suspicious google drive or google docs files shared outside or externally. This behavior might be a good hunting query to monitor exfitration of data made by an attacker or insider to a targetted machine. diff --git a/detections/endpoint/gsuite_email_suspicious_attachment.yml b/detections/cloud/gsuite_email_suspicious_attachment.yml similarity index 99% rename from detections/endpoint/gsuite_email_suspicious_attachment.yml rename to detections/cloud/gsuite_email_suspicious_attachment.yml index e2884f0cd9..eea3788ac6 100644 --- a/detections/endpoint/gsuite_email_suspicious_attachment.yml +++ b/detections/cloud/gsuite_email_suspicious_attachment.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-08-16' author: Teoderick Contreras, Splunk type: Anomaly -datamodel: -- Endpoint +datamodel: [] description: This search is to detect a suspicious attachment file extension in Gsuite email that may related to spear phishing attack. This file type is commonly used by malware to lure user to click on it to execute malicious code to compromised diff --git a/detections/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.yml b/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml similarity index 98% rename from detections/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.yml rename to detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml index 16f44567d9..7a4156ba7c 100644 --- a/detections/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.yml +++ b/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml @@ -4,9 +4,7 @@ version: 1 date: '2021-08-17' author: Teoderick Contreras, Stanislav Miskovic, Splunk type: Anomaly -datamodel: -- Endpoint -- Email +datamodel: [] description: This search is to detect a suspicious outbound e-mail from internal email to external email domain. This can be a good hunting query to monitor insider or outbound email traffic for not common domain e-mail. The idea is to parse the domain diff --git a/tests/endpoint/gsuite_drive_share_in_external_email.test.yml b/tests/cloud/gsuite_drive_share_in_external_email.test.yml similarity index 89% rename from tests/endpoint/gsuite_drive_share_in_external_email.test.yml rename to tests/cloud/gsuite_drive_share_in_external_email.test.yml index 7e2af359b6..7a4f05ed25 100644 --- a/tests/endpoint/gsuite_drive_share_in_external_email.test.yml +++ b/tests/cloud/gsuite_drive_share_in_external_email.test.yml @@ -1,7 +1,7 @@ name: Gsuite Drive Share In External Email Unit Test tests: - name: Gsuite Drive Share In External Email - file: endpoint/gsuite_drive_share_in_external_email.yml + file: cloud/gsuite_drive_share_in_external_email.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' diff --git a/tests/endpoint/gsuite_email_suspicious_attachment.test.yml b/tests/cloud/gsuite_email_suspicious_attachment.test.yml similarity index 89% rename from tests/endpoint/gsuite_email_suspicious_attachment.test.yml rename to tests/cloud/gsuite_email_suspicious_attachment.test.yml index 309b876695..3797bd45aa 100644 --- a/tests/endpoint/gsuite_email_suspicious_attachment.test.yml +++ b/tests/cloud/gsuite_email_suspicious_attachment.test.yml @@ -1,7 +1,7 @@ name: GSuite Email Suspicious Attachment Unit Test tests: - name: GSuite Email Suspicious Attachment - file: endpoint/gsuite_email_suspicious_attachment.yml + file: cloud/gsuite_email_suspicious_attachment.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' diff --git a/tests/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.test.yml b/tests/cloud/gsuite_outbound_email_with_attachment_to_external_domain.test.yml similarity index 87% rename from tests/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.test.yml rename to tests/cloud/gsuite_outbound_email_with_attachment_to_external_domain.test.yml index 59d3226b7d..dd56c43b8d 100644 --- a/tests/endpoint/gsuite_outbound_email_with_attachment_to_external_domain.test.yml +++ b/tests/cloud/gsuite_outbound_email_with_attachment_to_external_domain.test.yml @@ -1,7 +1,7 @@ name: Gsuite Outbound Email With Attachment To External Domain Unit Test tests: - name: Gsuite Outbound Email With Attachment To External Domain - file: endpoint/gsuite_outbound_email_with_attachment_to_external_domain.yml + file: cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now'