DeviceNetworkEvents
| where RemoteUrl has "drive.google.com" and InitiatingProcessFileName !in ("chrome.exe", "msedge.exe", "firefox.exe")
| where Timestamp > ago(7d)
| summarize Count=count(), DistinctProcesses=dcount(InitiatingProcessFileName) by DeviceId, RemoteUrl
| where DistinctProcesses > 1
| sort by Count desc


Identify potential Cobalt Strike beacons:

DeviceProcessEvents
| where ProcessVersionInfoOriginalFileName =~ "beacon.exe" or ProcessVersionInfoCompanyName == ""
| where Timestamp > ago(14d)
| extend FilePath = FolderPath + FileName
| summarize Count=count(), First=min(Timestamp), Last=max(Timestamp) by DeviceId, FilePath, SHA256
| sort by Count desc

# Check for suspicious processes connecting to Google Drive APIs
$SuspiciousConnections = Get-NetTCPConnection -State Established | 
    Where-Object {$_.RemoteAddress -ne $null} | 
    ForEach-Object {
        $Process = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        $RemoteIP = $_.RemoteAddress
        # Reverse DNS lookup for Google
        $DNSEntry = Resolve-DnsName -Name $RemoteIP -ErrorAction SilentlyContinue
        if ($DNSEntry.NameHost -like "*google.com*") {
            [PSCustomObject]@{
                ProcessName = $Process.ProcessName
                ProcessID = $_.OwningProcess
                RemoteAddress = $_.RemoteAddress
                RemotePort = $_.RemotePort
                State = $_.State
                CreatedTime = $Process.StartTime
            }
        }
    }
    
if ($SuspiciousConnections) {
    $SuspiciousConnections | Format-Table -AutoSize
    # Alert security team
    Write-Host "Suspicious Google Drive connections detected!" -ForegroundColor Red
} else {
    Write-Host "No suspicious connections found." -ForegroundColor Green
}

#!/usr/bin/env python3
"""
Silver Dragon Detection Script
Analyzes web proxy logs for suspicious Google Drive traffic patterns
"""

import re
import sys
from collections import defaultdict
from datetime import datetime, timedelta

def analyze_drive_logs(log_file, days=7):
    """
    Analyze proxy logs for anomalous Google Drive access patterns
    
    Args:
        log_file (str): Path to the proxy log file
        days (int): Number of days to analyze
    
    Returns:
        dict: Analysis results with suspicious IPs and users
    """
    # Pattern for Google Drive URLs
    drive_pattern = re.compile(r'drive\.google\.com')
    # Common user agents for browsers
    browser_ua = re.compile(r'(Chrome|Firefox|Safari|Edge|MSIE)', re.IGNORECASE)
    
    suspicious_activity = defaultdict(list)
    cutoff_date = datetime.now() - timedelta(days=days)
    
    try:
        with open(log_file, 'r', encoding='utf-8', errors='ignore') as f:
            for line in f:
                # Extract relevant fields (adjust based on your log format)
                parts = line.split()
                if len(parts) < 10:
                    continue
                    
                timestamp = parts[0] + ' ' + parts[1]
                try:
                    log_date = datetime.strptime(timestamp, '%Y-%m-%d %H:%M:%S')
                    if log_date < cutoff_date:
                        continue
                except ValueError:
                    continue
                    
                src_ip = parts[2]
                user_agent = ' '.join(parts[8:-1])
                url = parts[-1]
                
                # Check for Google Drive access
                if drive_pattern.search(url):
                    # Flag non-browser access
                    if not browser_ua.search(user_agent):
                        suspicious_activity[src_ip].append({
                            'timestamp': timestamp,
                            'url': url,
                            'user_agent': user_agent
                        })
    
    except FileNotFoundError:
        print(f"Error: File {log_file} not found.")
        return None
    
    return suspicious_activity

def main():
    if len(sys.argv) < 2:
        print("Usage: python3 silver_dragon_detect.py <proxy_log_file>")
        sys.exit(1)
    
    log_file = sys.argv[1]
    results = analyze_drive_logs(log_file)
    
    if not results:
        print("No suspicious activity detected.")
        return
    
    print(f"Found suspicious activity from {len(results)} unique IPs:\n")
    
    for ip, events in results.items():
        print(f"Source IP: {ip}")
        print(f"Number of suspicious events: {len(events)}")
        print("Sample events:")
        for event in events[:3]:  # Show first 3 events
            print(f"  - {event['timestamp']}: {event['url']}")
            print(f"    User-Agent: {event['user_agent']}")
        print()

if __name__ == "__main__":
    main()

# Example Cloud Access Security Broker (CASB) policy
google_drive_restriction:
  service: "Google Drive"
  actions:
    - "upload"
    - "share"
  restrictions:
    - "block_unknown_file_types"
    - "limit_external_sharing"
    - "require_dlp_scan"
  alert_on:
    - "bulk_download"
    - "unusual_access_patterns"

# PowerShell script to create WDAC policy for Silver Dragon mitigation
$PolicyPath = "C:\WDAC\SilverDragonPolicy.xml"
New-CIPolicy -Level Publisher -FilePath $PolicyPath -Fallback Hash -UserPEs
# Add rules to block common Silver Dragon tools
$Rule = @{
    "Id" = "block_cobalt_strike"
    "Action" = "Deny"
    "FileName" = "beacon.exe"
}
# Merge with existing policy and deploy


2. **Enable PowerShell logging and script block logging**:

# Enable enhanced PowerShell logging
$path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging"
if (-not (Test-Path $path)) {
    New-Item -Path $path -Force | Out-Null
}
Set-ItemProperty -Path $path -Name "EnableScriptBlockLogging" -Value 1 -Force

$path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription"
if (-not (Test-Path $path)) {
    New-Item -Path $path -Force | Out-Null
}
Set-ItemProperty -Path $path -Name "EnableTranscripting" -Value 1 -Force
Set-ItemProperty -Path $path -Name "OutputDirectory" -Value "C:\PowerShellLogs" -Force