Name:Gsuite Outbound Email With Attachment To External Domain id:dc4dc3a8-ff54-11eb-8bf7-acde48001122 version:4 date:2024-10-17 author:Teoderick Contreras, Stanislav Miskovic, Splunk status:production type:Hunting Description:The following analytic detects outbound emails with attachments sent from an internal email domain to an external domain. It leverages Gsuite Gmail logs, parsing the source and destination email domains, and flags emails with fewer than 20 outbound instances. This activity is significant as it may indicate potential data exfiltration or insider threats. If confirmed malicious, an attacker could use this method to exfiltrate sensitive information, leading to data breaches and compliance violations. Data_source:
-G Suite Gmail
search:`gsuite_gmail` num_message_attachments > 0 | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)" | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)" | where source_domain="internal_test_email.com" and not dest_domain="internal_test_email.com" | eval phase="plan" | eval severity="low" | stats values(subject) as subject, values(source.from_header_address) as src_domain_list, count as numEvents, dc(source.from_header_address) as numSrcAddresses, min(_time) as firstTime max(_time) as lastTime by dest_domain phase severity | where numSrcAddresses < 20 |sort - numSrcAddresses | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gsuite_outbound_email_with_attachment_to_external_domain_filter`
how_to_implement:To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. known_false_positives:network admin and normal user may send this file attachment as part of their day to day work. having a good protocol in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack. References: -https://www.redhat.com/en/topics/devops/what-is-devsecops drilldown_searches:
: tags: analytic_story: - 'Dev Sec Ops' - 'Insider Threat' asset_type:GSuite confidence:30 impact:30 message:Suspicious email from $src_domain_list$ to $dest_domain$ mitre_attack_id: - 'T1048.003' - 'T1048' observable: name:'src_domain_list' type:'Email Address' - role: - 'Victim' name:'dest_domain' type:'IP Address' - role: - 'Attacker' product: - 'Splunk Enterprise' - 'Splunk Enterprise Security' - 'Splunk Cloud' required_fields: - '_time' - 'source.from_header_address' - 'destination.address' - 'num_message_attachments' - 'dest_domain' - 'phase' - 'severity' risk_score:9 security_domain:endpoint
