Gsuite Suspicious Shared File Name

name: Gsuite Suspicious Shared File Name
id: 07eed200-03f5-11ec-98fb-acde48001122
version: 12
creation_date: '2021-08-23'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: experimental
type: Anomaly
description: The following analytic detects shared files in Google Drive with suspicious filenames commonly used in spear phishing campaigns. It leverages GSuite Drive logs to identify documents with titles that include keywords like "dhl," "ups," "invoice," and "shipment." This activity is significant because such filenames are often used to lure users into opening malicious documents or clicking harmful links. If confirmed malicious, this activity could lead to unauthorized access, data theft, or further compromise of the user's system.
data_source:
    - G Suite Drive
search: |-
    `gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_title" IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") parameters.doc_type IN ("document","pdf", "msexcel", "msword", "spreadsheet", "presentation")
      | rex field=parameters.owner "[^@]+@(?<source_domain>[^@]+)"
      | rex field=parameters.target_user "[^@]+@(?<dest_domain>[^@]+)"
      | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com"
      | eval phase="plan"
      | eval severity="low"
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY email parameters.owner parameters.target_user
           parameters.doc_title parameters.doc_type phase
           severity
      | rename parameters.target_user AS user
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `gsuite_suspicious_shared_file_name_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. In order for the search to work for your environment, please edit the query to use your company specific email domain instead of `internal_test_email.com`.
known_false_positives: normal user or normal transaction may contain the subject and file type attachment that this detection try to search
references:
    - https://www.redhat.com/en/topics/devops/what-is-devsecops
    - https://www.mandiant.com/resources/top-words-used-in-spear-phishing-attacks
intermediate_findings:
    entities:
        - field: email
          type: user
          score: 20
          message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$
        - field: parameters.owner
          type: user
          score: 20
          message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$
analytic_story:
    - Dev Sec Ops
asset_type: GSuite
mitre_attack_id:
    - T1566.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: endpoint