YARA-L rules: 3c

// Copyright 2024 Google LLC. Licensed under Apache-2.0.

 rule gcp_successful_api_from_tor_exit_node {

  meta:
    author = "Google Cloud Security"
    description = "Detects successful API executions from a Tor exit node."
    rule_id = "mr_5912e2be-4366-4f34-a770-0ac8358f2cb9"
    rule_name = "GCP Successful API Call From Tor Exit Node"
    mitre_attack_tactic = "Execution"
    mitre_attack_technique = "User Execution"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1204/"
    mitre_attack_version = "v14.1"
    type = "Alert"
    data_source = "GCP Cloud Audit"
    platform = "GCP"
    severity = "High"
    priority = "High"

  events:

    $gcp.metadata.log_type = "GCP_CLOUDAUDIT"
    $gcp.security_result.action = "ALLOW"
    $gcp.principal.ip = $ip

    // Tor IP listing provided by GCTI Feed
    $gcti_feed.graph.entity.artifact.ip = $ip
    $gcti_feed.graph.metadata.entity_type = "IP_ADDRESS"
    $gcti_feed.graph.metadata.threat.threat_feed_name = "Tor Exit Nodes"
    $gcti_feed.graph.metadata.product_name = "GCTI Feed"
    $gcti_feed.graph.metadata.source_type = "GLOBAL_CONTEXT"

  match:
    $ip over 5m

  outcome:
    $risk_score = max(
        //Baseline
        35 +
        // Unauthorized geographies
        if($gcp.principal.ip_geo_artifact.location.country_or_region = "Cuba", 40) +
        if($gcp.principal.ip_geo_artifact.location.country_or_region = "Iran", 40) +
        if($gcp.principal.ip_geo_artifact.location.country_or_region = "North Korea" , 40) +
        if($gcp.principal.ip_geo_artifact.location.country_or_region = "Russia", 40) +
        if($gcp.principal.ip_geo_artifact.location.country_or_region = "Syria", 40)
    )
    $mitre_attack_tactic = "Execution"
    $mitre_attack_technique = "User Execution"
    $mitre_attack_technique_id = "T1204"
    $event_count = count_distinct($gcp.metadata.id)
    $network_http_user_agent = array_distinct($gcp.network.http.user_agent)
    $principal_ip = array_distinct($gcp.principal.ip)
    $principal_ip_country = array_distinct($gcp.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($gcp.principal.ip_geo_artifact.location.state)
    $principal_user_display_name = array_distinct($gcp.principal.user.user_display_name)
    $dc_principal_user_display_name = count_distinct($gcp.principal.user.user_display_name)
    $target_resource_name = array_distinct($gcp.target.resource.name)

  condition:
    $gcp and $gcti_feed
}

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule google_workspace_multiple_files_sent_as_email_attachment_from_google_drive {

  meta:
    author = "Google Cloud Security"
    description = "Identifies when a user sends multiple files from Google Drive as an email attachment to a free email domain, which may indicate data exfiltration."
    rule_id = "mr_125c517c-3ef9-4687-8af6-d71eff83d0e9"
    rule_name = "Google Workspace Multiple Files Sent As Email Attachments From Google Drive"
    mitre_attack_tactic = "Exfiltration"
    mitre_attack_technique = "Exfiltration Over Web Service"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1567/"
    mitre_attack_version = "v13.1"
    type = "Alert"
    data_source = "Workspace Activity"
    severity = "High"
    priority = "High"

  events:
    $email.metadata.vendor_name = "Google Workspace"
    $email.metadata.product_name = "drive"
    $email.metadata.event_type = "EMAIL_TRANSACTION"
    $email.metadata.product_event_type = "email_as_attachment"
    $email.target.user.email_addresses = /.*@gmail\.com|.*@aol\.com|.*@ymail\.com|.*@ymail\.com|.*@hotmail\.com|.*@outlook\.com|.*@icloud\.com/
    $email.principal.user.userid = $user_id

  match:
    $user_id over 1h

  outcome:
    $risk_score = max(75)
    $mitre_attack_tactic = "Exfiltration"
    $mitre_attack_technique = "Exfiltration Over Web Service"
    $mitre_attack_technique_id = "T1567"
    $event_count = count_distinct($email.metadata.id)
    $product_event_type = array_distinct($email.metadata.product_event_type)
    $userid = array_distinct($email.principal.user.userid)
    $doc_type = array_distinct($email.src.resource.attribute.labels["doc_type"])
    $owner = array_distinct($email.target.resource.attribute.labels["owner"])
    $target_emails = array_distinct($email.target.user.email_addresses)
    $doc_name = array_distinct($email.target.resource.name)
    $doc_id = array_distinct($email.target.resource.product_object_id)
    $count_docs = count_distinct($email.target.resource.product_object_id)

  condition:
    // Customize the value of $count_docs to set the alerting threshold for your environment
    $email and $count_docs > 10
}

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

rule o365_login_activity_to_azure_ad_powershell_app {

  meta:
    author = "Google Cloud Security"
    description = "Logins to Azure AD PowerShell app can have legitimate purposes, but are also abused to gain access to user information. Programmatic access to Entra ID (Azure AD) should generally be through apps, so reviewing these activities is needed."
    rule_id = "mr_0cc56eaf-4176-444d-874d-9780bbb29d4f"
    rule_name = "O365 Login Activity To Azure AD PowerShell App"
    tactic = "TA0001"
    technique = "T1078.004"
    type = "hunt"
    platform = "azure"
    data_source = "o365"
    severity = "Medium"
    priority = "Medium"

  events:
    $login.metadata.event_type = "USER_LOGIN"
    $login.metadata.product_event_type = "UserLoggedIn"
    $login.metadata.product_name = "Office 365"
    $login.metadata.vendor_name = "Microsoft"
    $login.target.resource.product_object_id = "1b730954-1685-4b74-9bfd-dac224a7b894"
    $login.security_result.action = "ALLOW"

    // Below filters ADFS Sync Account that runs every 30 minutes between AD and Entra ID (for federated environments); can use display name or email address
    //$login.target.user.userid != "insert your email address here" and
    //$login.target.user.user_display_name != "On-Premises Directory Synchronization Service Account"
    $login.target.user.userid = $userid

  match:
    $userid over 5m

  outcome:
    $risk_score = 65
    $event_count = count_distinct($login.metadata.id)
    $security_summary = array_distinct($login.security_result.summary)
    $user_agent = array_distinct($login.network.http.user_agent)
    $country_region_login_attempt = array_distinct($login.principal.ip_geo_artifact.location.country_or_region)
    //added to populate alert graph with additional context
    $principal_ip = array_distinct($login.principal.ip)
    $target_user_userid = array_distinct($login.target.user.userid)

  condition:
    $login
}