GWorkspace - Possible maldoc file name in Google drive

Status: available
Severity: medium
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

'Detects possible maldoc file name in Google drive.'

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1566` Phishing

Rule body

id: d80d02a8-5da6-11ec-bf63-0242ac130002
name: GWorkspace - Possible maldoc file name in Google drive
description: |
  'Detects possible maldoc file name in Google drive.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: GoogleWorkspaceReportsAPI
    dataTypes:
      - GWorkspaceActivityReports
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  GWorkspaceActivityReports
  | where isnotempty(DocTitle)
  | where DocTitle contains "invoice" or DocTitle contains "payment" or DocTitle contains "order" or DocTitle contains "fax" or DocTitle contains "scan" or DocTitle contains "transfer" or DocTitle contains "report" or DocTitle contains "bill"
  | extend FileCustomEntity = DocTitle, AccountCustomEntity = ActorEmail
entityMappings:
  - entityType: File
    fieldMappings:
      - identifier: Name
        columnName: FileCustomEntity
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountCustomEntity
version: 1.0.1
kind: Scheduled

Stages and Predicates

Stage 1: `source`

GWorkspaceActivityReports

Stage 2: `where`

| where isnotempty(DocTitle)

Stage 3: `where`

| where DocTitle contains "invoice" or DocTitle contains "payment" or DocTitle contains "order" or DocTitle contains "fax" or DocTitle contains "scan" or DocTitle contains "transfer" or DocTitle contains "report" or DocTitle contains "bill"

Stage 4: `extend`

| extend FileCustomEntity = DocTitle, AccountCustomEntity = ActorEmail

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`DocTitle`	contains	`bill` `fax` `invoice` `order` `payment` `report` `scan` `transfer`	`field:"DocTitle" kind:contains`
`DocTitle`	is_not_null	(no value, null check)	`field:"DocTitle" kind:is_not_null`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AccountCustomEntity`	`extend`
`FileCustomEntity`	`extend`

GWorkspace - Possible maldoc file name in Google drive

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: extend

Indicators

Output fields

Stage 1: `source`

Stage 2: `where`

Stage 3: `where`

Stage 4: `extend`