gmail_spike_in_undeliverables

rule gmail_spike_in_undeliverables {

  meta:
    author = "Bastradamus"
    description = "Detects a spike in undeliverable emails, this can be an early indication of a targeted phishing campaign or a compromised user account."
    severity = "Medium"
    priority = "Medium"
    type = "alert"
    platform = "Google workspace"
    data_source = "Workspace Activity, gmail"
    mitre_attack_tactic = "Initial Access"
    mitre_attack_technique = "Phishing"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1566/"

  events:
    $email.metadata.vendor_name = "Google Workspace"
    $email.metadata.product_name = "gmail"
    $email.metadata.event_type = "EMAIL_TRANSACTION"
    $email.network.email.subject = /Undeliverable\:/ nocase
    $email.target.user.email_addresses = $user
    $email.network.email.subject = $subject

  match:
    $user over 10m

  outcome:
    $mitre_attack_tactic = array_distinct("Initial Access")
    $mitre_attack_technique = array_distinct("Phishing")
    $mitre_attack_technique_id = array_distinct("T1566")
    $event_count = count_distinct($email.metadata.description)
    $target_user_distinct_count = count_distinct($user)
    $target_user_count = count($user)
    $principal_ip = array_distinct($email.principal.ip)
    $count_subject_bounce = count_distinct($subject)
    $count_bounce_distinct_mail_id = count_distinct($email.network.email.mail_id)
    $sender_from = array_distinct($email.principal.network.email.from)

  condition:
    $email and $count_bounce_distinct_mail_id > 10 and $count_subject_bounce = 1
}