YARA-L rules: 2j

// Copyright 2024 Google LLC. Licensed under Apache-2.0.

 rule gcp_exempt_principals_from_audit_log  {

  meta:
    author = "Google Cloud Security"
    description = "Detect when GCP Cloud Audit logs are exempted for principals in all services at project or organization level. Audit logging helps organizations maintain security and minimize risk."
    rule_id = "mr_6ebf472c-bf50-468c-a0b1-e0f53dd91a61"
    rule_name = "GCP Exempt Principals From Audit Log"
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "Impair Defenses: Disable Cloud Logs"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1562/008/"
    mitre_attack_version = "v14.1"
    type = "Alert"
    data_source = "GCP Cloud Audit"
    platform = "GCP"
    severity = "High"
    priority = "High"

  events:
    $gcp.metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
    $gcp.metadata.log_type = "GCP_CLOUDAUDIT"
    $gcp.metadata.product_event_type = "SetIamPolicy"
    $gcp.security_result.action = "ALLOW"
    $gcp.target.application = "cloudresourcemanager.googleapis.com"
    any $gcp.target.resource.attribute.labels.value = "ADD"
    any $gcp.target.resource.attribute.labels.value = "allServices"
    any $gcp.target.resource.attribute.labels.key = /service_data_policy_delta_audit_config_delta_.*_exempted_member/

  outcome:
    //Increase risk score if it is organization wide
    $risk_score = max(45 +
      if($gcp.target.resource.name = /organizations/,30,0)
    )
    $mitre_attack_tactic = "Defense Evasion"
    $mitre_attack_technique = "Impair Defenses: Disable Cloud Logs"
    $mitre_attack_technique_id = "T1562.008"
    $event_count = count_distinct($gcp.metadata.id)
    $network_http_user_agent = array_distinct($gcp.network.http.user_agent)
    $principal_ip = array_distinct($gcp.principal.ip)
    $principal_ip_country = array_distinct($gcp.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($gcp.principal.ip_geo_artifact.location.state)
    $principal_user_id = $gcp.principal.user.userid
    $principal_user_display_name = $gcp.principal.user.user_display_name
    $target_resource_name = $gcp.target.resource.name
    $event_name = $gcp.metadata.product_event_type

  condition:
    $gcp
}

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule google_workspace_marketplace_allowlist_configuration {

  meta:
    author = "Google Cloud Security"
    description = "Identifies when the Google Workspace Marketplace allowlist is configured to allow users to install and run any apps from the Marketplace. Allowing users to install and run any apps may increase the organization's risk of data exfiltration/leakage and increase its attack surface."
    rule_id = "mr_3dd74ce1-27cb-4c57-b4cf-4cfb29293ab5"
    rule_name = "Google Workspace Marketplace Allowlist Configuration"
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "Impair Defenses: Disable or Modify Tools"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1562/001/"
    mitre_attack_version = "v13.1"
    type = "Alert"
    data_source = "Workspace Activity"
    severity = "Low"
    priority = "Low"

  events:
    $ws.metadata.vendor_name = "Google Workspace"
    $ws.metadata.product_name = "admin"
    $ws.metadata.product_event_type = "CHANGE_APPLICATION_SETTING"
    $ws.security_result.category_details = "APPLICATION_SETTINGS"
    $ws.target.application = "Google Workspace Marketplace"
    $ws.target.resource.name = "Apps Access Setting Allowlist access"
    $ws.target.resource.attribute.labels["new_value"] = "ALLOW_ALL"

  outcome:
    $risk_score = max(35)
    $mitre_attack_tactic = "Defense Evasion"
    $mitre_attack_technique = "Impair Defenses: Disable or Modify Tools"
    $mitre_attack_technique_id = "T1562.001"
    $event_count = count_distinct($ws.metadata.id)
    $principal_ip = array_distinct($ws.principal.ip)
    $principal_country = array_distinct($ws.principal.ip_geo_artifact.location.country_or_region)
    $principal_state = array_distinct($ws.principal.ip_geo_artifact.location.state)
    $principal_user_emails = array_distinct($ws.principal.user.email_addresses)
    $principal_user_id = array_distinct($ws.principal.user.userid)
    $target_application = $ws.target.application

  condition:
    $ws
}

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule suspicious_asn_watchlist {

  meta:
    author = "Google Cloud Security"
    description = "Identify any network connections to a list of ASNs"
    rule_id = "mr_4b4311e2-8505-4758-8435-dbd951d2ee0d"
    rule_name = "Suspicious ASN Watchlist"
    type = "alert"
    tags = "geoip enrichment, list"
    assumption = "List named suspicious_asn needs to be created and populated"
    data_source = "microsoft windows events"
    severity = "Low"
    priority = "Low"

  events:
    $network.metadata.event_type = "NETWORK_CONNECTION"
    // Specify multiple autonomoous system numbers using a list called suspicious_asn
    $network.target.ip_geo_artifact.network.asn in %suspicious_asn
    $network.target.ip = $ip

  match:
    $ip over 30m

 outcome:
    $risk_score = max(35)
    $event_count = count_distinct($network.metadata.id)
    // added to populate alert graph with additional context
    $principal_ip = array_distinct($network.principal.ip)
    // Commented out target.ip because it is already represented in graph as match variable. If match changes, can uncomment to add to results
    //$target_ip = array_distinct($network.target.ip)
    $principal_process_pid = array_distinct($network.principal.process.pid)
    $principal_process_command_line = array_distinct($network.principal.process.command_line)
    $principal_process_file_sha256 = array_distinct($network.principal.process.file.sha256)
    $principal_process_file_full_path = array_distinct($network.principal.process.file.full_path)
    $principal_process_product_specific_process_id = array_distinct($network.principal.process.product_specific_process_id)
    $principal_process_parent_process_product_specific_process_id = array_distinct($network.principal.process.parent_process.product_specific_process_id)
    $target_process_pid = array_distinct($network.target.process.pid)
    $target_process_command_line = array_distinct($network.target.process.command_line)
    $target_process_file_sha256 = array_distinct($network.target.process.file.sha256)
    $target_process_file_full_path = array_distinct($network.target.process.file.full_path)
    $target_process_product_specific_process_id = array_distinct($network.target.process.product_specific_process_id)
    $target_process_parent_process_product_specific_process_id = array_distinct($network.target.process.parent_process.product_specific_process_id)
    $principal_user_userid = array_distinct($network.principal.user.userid)
    $target_user_userid = array_distinct($network.target.user.userid)

  condition:
    $network
}