Detection: Gsuite suspicious calendar invite

EXPERIMENTAL DETECTION

This detection status is set to experimental. The Splunk Threat Research team has not yet fully tested, simulated, or built comprehensive datasets for this detection. As such, this analytic is not officially supported. If you have any questions or concerns, please reach out to us at research@splunk.com.

Updated Date: 2024-10-17 ID: 03cdd68a-34fb-11ec-9bd3-acde48001122 Author: Rod Soto, Teoderick Contreras Type: Hunting Product: Splunk Enterprise Security

Description

The following analytic detects suspicious calendar invites sent via GSuite, potentially indicating compromised accounts or malicious internal activity. It leverages GSuite calendar logs, focusing on events where a high volume of invites (over 100) is sent within a 5-minute window. This behavior is significant as it may involve the distribution of malicious links or attachments, posing a security risk. If confirmed malicious, this activity could lead to widespread phishing attacks, unauthorized access, or malware distribution within the organization.

Search

1`gsuite_calendar` 
2|bin span=5m _time 
3|rename parameters.* as * 
4|search target_calendar_id!=null email="*yourdomain.com"
5| stats  count values(target_calendar_id) values(event_title) values(event_guest) by email _time 
6| where count >100
7| `gsuite_suspicious_calendar_invite_filter`

Data Source

No data sources specified for this detection.

Macros Used

Name	Value
gsuite_calendar	`sourcetype=gsuite:calendar:json`
gsuite_suspicious_calendar_invite_filter	`search *`

gsuite_suspicious_calendar_invite_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1566	Phishing	Initial Access

KillChainPhase.DELIVERY

NistCategory.DE_AE

Cis18Value.CIS_10

Axiom

GOLD SOUTHFIELD

INC Ransom

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Risk Event	False

This configuration file applies to all detections of type hunting.

Implementation

In order to successfully implement this search, you need to be ingesting logs related to gsuite (gsuite:calendar:json) having the file sharing metadata like file type, source owner, destination target user, description, etc. This search can also be made more specific by selecting specific emails, subdomains timeframe, organizational units, targeted user, etc. In order for the search to work for your environment please update yourdomain.com value in the query with the domain relavant for your organization.

Known False Positives

This search will also produce normal activity statistics. Fields such as email, ip address, name, parameters.organizer_calendar_id, parameters.target_calendar_id and parameters.event_title may give away phishing intent.For more specific results use email parameter.

Associated Analytic Story

Spearphishing Attachments

Risk Based Analytics (RBA)

Risk Message	Risk Score	Impact	Confidence
Gsuite suspicious calendar invite sent by $email$	25	50	50

The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	Not Applicable	N/A	N/A	N/A
Unit	❌ Failing	N/A	`N/A`	`N/A`
Integration	❌ Failing	N/A	`N/A`	`N/A`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 3