GSuite Login Type

AnalysisType: rule
Filename: gsuite_login_type.py
RuleID: "GSuite.LoginType"
DisplayName: "GSuite Login Type"
Enabled: false
LogTypes:
  - GSuite.ActivityEvent
Tags:
  - GSuite
  - Configuration Required
  - Initial Access:Valid Accounts
Reports:
  MITRE ATT&CK:
    - TA0001:T1078
Severity: Medium
Description: >
  A login of a non-approved type was detected for this user.
Reference: https://support.google.com/a/answer/9039184?hl=en&sjid=864417124752637253-EU
Runbook: >
  Correct the user account settings so that only logins of approved types are available.
SummaryAttributes:
  - actor:email
Tests:
  - Name: Login With Approved Type
    ExpectedResult: false
    Log:
      {
        "id": { "applicationName": "login" },
        "actor": { "email": "some.user@somedomain.com" },
        "type": "login",
        "name": "login_success",
        "parameters": { "login_type": "saml" },
      }
  - Name: Login With Unapproved Type
    ExpectedResult: true
    Log:
      {
        "id": { "applicationName": "login" },
        "actor": { "email": "some.user@somedomain.com" },
        "type": "login",
        "name": "login_success",
        "parameters": { "login_type": "turbo-snail" },
      }
  - Name: Non-Login event
    ExpectedResult: false
    Log:
      {
        "id": { "applicationName": "logout" },
        "actor": { "email": "some.user@somedomain.com" },
        "type": "login",
        "name": "login_success",
        "parameters": { "login_type": "saml" },
      }
  - Name: Saml Login Event
    ExpectedResult: false
    Log:
      {
        "actor": { "email": "some.user@somedomain.com" },
        "id":
          {
            "applicationName": "saml",
            "time": "2022-05-26 15:26:09.421000000",
          },
        "ipAddress": "10.10.10.10",
        "kind": "admin#reports#activity",
        "name": "login_success",
        "parameters":
          {
            "application_name": "Some SAML Application",
            "initiated_by": "sp",
            "orgunit_path": "/SomeOrgUnit",
            "saml_status_code": "SUCCESS_URI",
          },
        "type": "login",
      }


# ------ paired body: gsuite_login_type.py ------

# allow-list of approved login types
# comment or uncomment approved login types as needed
APPROVED_LOGIN_TYPES = {
    "exchange",
    "google_password",
    "reauth",
    "saml",
    # "unknown",
}

# allow-list any application names here
APPROVED_APPLICATION_NAMES = {"saml"}


def rule(event):
    if event.get("type") != "login":
        return False

    if event.get("name") == "logout":
        return False

    if (
        event.deep_get("parameters", "login_type") in APPROVED_LOGIN_TYPES
        or event.deep_get("id", "applicationName") in APPROVED_APPLICATION_NAMES
    ):
        return False

    return True


def title(event):
    return (
        f"A login attempt of a non-approved type was detected for user "
        f"[{event.deep_get('actor', 'email', default='<UNKNOWN_USER>')}]"
    )