Detect Data from Information Repositories in Google Chronicle

rule t1213_data_from_information_repositories {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects bulk file access/download from SharePoint or OneDrive exceeding 50 operations per hour, sensitive keyword searches, and bulk external sharing — indicators of adversarial data mining from information repositories (T1213)"
    mitre_attack_tactic = "Collection"
    mitre_attack_technique = "T1213"
    mitre_attack_subtechnique = "T1213.002"
    severity = "HIGH"
    confidence = "MEDIUM"
    created = "2024-01-01"
    version = "1.0"

  events:
    $e.metadata.event_type = "USER_RESOURCE_ACCESS"
    $e.metadata.product_name = /(?i)sharepoint|onedrive|office 365/
    $e.target.application = /(?i)sharepoint|onedrive/
    $e.metadata.product_event_type = /(?i)FileDownloaded|FileSyncDownloadedFull|FileAccessed|FilePreviewed|FileSyncUploadedFull/
    $e.principal.user.userid = $user
    $e.metadata.event_timestamp.seconds > 0

  match:
    $user over 1h

  outcome:
    $operation_count = count_distinct($e.metadata.product_event_type)
    $unique_files = count_distinct($e.target.url)
    $source_ips = array_distinct($e.principal.ip)
    $risk_level = if($operation_count >= 500, "Critical",
                   if($operation_count >= 200, "High",
                   if($operation_count >= 50, "Medium", "Low")))

  condition:
    #e >= 50
}

// Companion rule for sensitive keyword searches:
// rule t1213_sensitive_keyword_search {
//   meta:
//     description = "Detects sensitive keyword searches in SharePoint indicative of credential or architecture harvesting"
//     mitre_attack_technique = "T1213"
//   events:
//     $e.metadata.event_type = "USER_RESOURCE_ACCESS"
//     $e.metadata.product_name = /(?i)sharepoint/
//     $e.metadata.product_event_type = "SearchQueryPerformed"
//     $e.target.resource.name = /(?i)password|credential|secret|vpn|api.key|private.key|connection.string|network.diagram|architecture|payroll|salary/
//     $e.principal.user.userid = $user
//   match:
//     $user over 1h
//   condition:
//     #e >= 3
// }