sap_download_from_threat_intel_matched_ip

rule sap_download_from_threat_intel_matched_ip {

  meta:
    author = "Google Cloud Security"
    description = "A file was downloaded from an SAP system by a host matching a threat intelligence indicator"
    severity = "High"
    tactic = "TA0011"
    technique = "T1105"
    //requires Enterprise+ License for Native GTI_IOC data

  events:
    $e.metadata.log_type = "SAP_SECURITY_AUDIT"
    $e.additional.fields["msg_1"] = "AUY"

    $e.target.application = $sid
    $e.target.resource.attribute.labels["slgmand_1"] = $client
    $e.principal.user.userid = $user
    $e.principal.ip = $terminal_ip

    $ioc.graph.entity.ip = $terminal_ip
    (
      $ioc.graph.metadata.product_name = "MANDIANT_FUSION_IOC" OR
      $ioc.graph.metadata.product_name = "GTI_IOC"
    )

  match:
    $sid, $client, $user, $terminal_ip over 1h

  outcome:
    $message_ids = array_distinct($e.additional.fields["msg_1"])
    $paths = array_distinct($e.additional.fields["param3_1"])
    $byte_count =
      sum(
        cast.as_int(
          re.replace(
            re.replace(
              $e.additional.fields["param1_1"],
              "\\.",
              ""
            ),
            ",",
            ""
          )
        )
      )

  condition:
    $e  and $ioc
}