From efe3af1edb1aa2d904c731981b47b73713f63521 Mon Sep 17 00:00:00 2001 From: Daniel Bolton Date: Tue, 8 Sep 2026 11:17:24 -0500 Subject: [PATCH] Add google drive logo --- .../impersonation_google_drive_file_share.yml | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/detection-rules/impersonation_google_drive_file_share.yml b/detection-rules/impersonation_google_drive_file_share.yml index a2d609b1002..ad34f5064d0 100644 --- a/detection-rules/impersonation_google_drive_file_share.yml +++ b/detection-rules/impersonation_google_drive_file_share.yml @@ -5,7 +5,7 @@ type: "rule" severity: "medium" source: | type.inbound - + // Google Drive body content looks like this and ( ( @@ -138,7 +138,7 @@ source: | strings.icontains(subject.subject, .) ) ) - + // contains logic that impersonates Google and ( any(ml.logo_detect(file.message_screenshot()).brands, @@ -232,6 +232,15 @@ source: | strings.icontains(body.current_thread.text, '1600 Amphitheatre Parkway'), strings.icontains(body.current_thread.text, 'Mountain View, CA 94043'), ) + or ( + html.xpath(body.html, "//span[contains(@style, 'color')]").nodes[0].display_text == 'G' + and html.xpath(body.html, "//span[contains(@style, 'color')]").nodes[1].display_text == 'o' + and html.xpath(body.html, "//span[contains(@style, 'color')]").nodes[2].display_text == 'o' + and html.xpath(body.html, "//span[contains(@style, 'color')]").nodes[3].display_text == 'g' + and html.xpath(body.html, "//span[contains(@style, 'color')]").nodes[4].display_text == 'l' + and html.xpath(body.html, "//span[contains(@style, 'color')]").nodes[5].display_text == 'e' + and html.xpath(body.html, "//span[contains(@style, 'color')]").nodes[6].display_text == 'Drive' + ) ) and not ( // Google Sites has been observed abused @@ -255,7 +264,7 @@ source: | .href_url.domain.root_domain == "google.com" ) ) - + // negate highly trusted sender domains unless they fail DMARC authentication and ( (