Swap detections to experimental as test data no longer matches expectations of TA

Author: ljstella

detections/cloud/gsuite_drive_share_in_external_email.yml

@@ -3,7 +3,7 @@ id: f6ee02d6-fea0-11eb-b2c2-acde48001122
 version: 8
 date: '2025-06-10'
 author: Teoderick Contreras, Splunk
-status: production
+status: Experimental
 type: Anomaly
 description:
   The following analytic detects Google Drive or Google Docs files shared

detections/cloud/gsuite_suspicious_shared_file_name.yml

@@ -3,18 +3,20 @@ id: 07eed200-03f5-11ec-98fb-acde48001122
 version: 7
 date: '2025-05-02'
 author: Teoderick Contreras, Splunk
-status: production
+status: Experimental
 type: Anomaly
-description: The following analytic detects shared files in Google Drive with suspicious
+description:
+  The following analytic detects shared files in Google Drive with suspicious
   filenames commonly used in spear phishing campaigns. It leverages GSuite Drive logs
   to identify documents with titles that include keywords like "dhl," "ups," "invoice,"
   and "shipment." This activity is significant because such filenames are often used
   to lure users into opening malicious documents or clicking harmful links. If confirmed
   malicious, this activity could lead to unauthorized access, data theft, or further
   compromise of the user's system.
 data_source:
-- G Suite Drive
-search: '`gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_title"
+  - G Suite Drive
+search:
+  '`gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_title"
   IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*",
   "*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*",
   "*new order*") parameters.doc_type IN ("document","pdf", "msexcel", "msword", "spreadsheet",
@@ -25,55 +27,57 @@ search: '`gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_tit
   parameters.target_user parameters.doc_title parameters.doc_type phase severity |
   rename parameters.target_user AS user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `gsuite_suspicious_shared_file_name_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
+how_to_implement:
+  To successfully implement this search, you need to be ingesting
   logs related to gsuite having the file attachment metadata like file type, file
   extension, source email, destination email, num of attachment and etc. In order
   for the search to work for your environment, please edit the query to use your company
   specific email domain instead of `internal_test_email.com`.
-known_false_positives: normal user or normal transaction may contain the subject and
+known_false_positives:
+  normal user or normal transaction may contain the subject and
   file type attachment that this detection try to search
 references:
-- https://www.redhat.com/en/topics/devops/what-is-devsecops
-- https://www.mandiant.com/resources/top-words-used-in-spear-phishing-attacks
+  - https://www.redhat.com/en/topics/devops/what-is-devsecops
+  - https://www.mandiant.com/resources/top-words-used-in-spear-phishing-attacks
 drilldown_searches:
-- name: View the detection results for - "$email$"
-  search: '%original_detection_search% | search  email = "$email$"'
-  earliest_offset: $info_min_time$
-  latest_offset: $info_max_time$
-- name: View risk events for the last 7 days for - "$email$"
-  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$email$")
-    starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime
-    values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
-    as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
-    as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`'
-  earliest_offset: $info_min_time$
-  latest_offset: $info_max_time$
+  - name: View the detection results for - "$email$"
+    search: '%original_detection_search% | search  email = "$email$"'
+    earliest_offset: $info_min_time$
+    latest_offset: $info_max_time$
+  - name: View risk events for the last 7 days for - "$email$"
+    search:
+      '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$email$")
+      starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime
+      values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
+      as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
+      as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
+      | `security_content_ctime(lastTime)`'
+    earliest_offset: $info_min_time$
+    latest_offset: $info_max_time$
 rba:
   message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$
   risk_objects:
-  - field: email
-    type: user
-    score: 21
-  - field: parameters.owner
-    type: user
-    score: 21
+    - field: email
+      type: user
+      score: 21
+    - field: parameters.owner
+      type: user
+      score: 21
   threat_objects: []
 tags:
   analytic_story:
-  - Dev Sec Ops
+    - Dev Sec Ops
   asset_type: GSuite
   mitre_attack_id:
-  - T1566.001
+    - T1566.001
   product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
   security_domain: endpoint
 tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gdrive_susp_file_share/gdrive_susp_attach.log
-    source: http:gsuite
-    sourcetype: gsuite:drive:json
+  - name: True Positive Test
+    attack_data:
+      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gdrive_susp_file_share/gdrive_susp_attach.log
+        source: http:gsuite
+        sourcetype: gws:reports:drive