Detection rules › Panther
GSuite Document External Ownership Transfer
A GSuite document's ownership was transferred to an external party.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Collection | T1213 Data from Information Repositories |
Rule body yaml
AnalysisType: rule
Filename: gsuite_doc_ownership_transfer.py
RuleID: "GSuite.DocOwnershipTransfer"
DisplayName: "GSuite Document External Ownership Transfer"
Enabled: true
LogTypes:
- GSuite.ActivityEvent
Tags:
- GSuite
- Collection:Data from Information Repositories
Reports:
MITRE ATT&CK:
- TA0009:T1213
Severity: Low
Description: >
A GSuite document's ownership was transferred to an external party.
Reference: https://support.google.com/drive/answer/2494892?hl=en&co=GENIE.Platform%3DDesktop&sjid=864417124752637253-EU
Runbook: >
Verify that this document did not contain sensitive or private company information.
SummaryAttributes:
- actor:email
Tests:
- Name: Ownership Transferred Within Organization
ExpectedResult: false
Log:
{
"actor": {
"email": "alice@panther.com",
"profileId": "1234567890"
},
"id": {
"applicationName": "drive",
"customerId": "C123abcde",
"time": "2025-08-12 18:41:56.232000000",
"uniqueQualifier": "1234567890"
},
"ipAddress": "1.2.3.4",
"kind": "admin#reports#activity",
"name": "change_owner",
"parameters": {
"billable": true,
"doc_id": "1234567890",
"doc_title": "sensitive_document.xlsx",
"doc_type": "msexcel",
"new_owner": "bob@panther.com",
"owner": "alice@panther.com",
"primary_event": true,
"visibility": "shared_internally"
},
"type": "acl_change"
}
- Name: Document Transferred to External User
ExpectedResult: true
Log:
{
"actor": {
"email": "alice@panther.com",
"profileId": "1234567890"
},
"id": {
"applicationName": "drive",
"customerId": "C123abcde",
"time": "2025-07-11 19:50:09.324000000",
"uniqueQualifier": "1234567890"
},
"kind": "admin#reports#activity",
"name": "change_owner",
"parameters": {
"billable": true,
"doc_id": "1234567890",
"doc_title": "sensitive_document.xlsx",
"doc_type": "msexcel",
"new_owner": "bob@example.com",
"owner": "alice@panther.com",
"primary_event": true,
"visibility": "unknown"
},
"type": "acl_change"
}
- Name: Document Transferred to Group within Organization
ExpectedResult: false
Log:
{
"actor": {
"email": "alice@panther.com",
"profileId": "100606748236723241722"
},
"id": {
"applicationName": "drive",
"customerId": "C123abcde",
"time": "2025-07-07 23:50:22.743000000",
"uniqueQualifier": "1234567890"
},
"ipAddress": "1.2.3.4",
"kind": "admin#reports#activity",
"name": "change_owner",
"parameters": {
"billable": true,
"doc_id": "1234567890",
"doc_title": "sensitive_document.xlsx",
"doc_type": "msexcel",
"new_owner": "Execs",
"new_owner_is_team_drive": true,
"new_owner_team_drive_id": "1234567890",
"originating_app_id": "1234567890",
"owner": "Engineering",
"owner_is_shared_drive": true,
"owner_is_team_drive": true,
"owner_team_drive_id": "1234567890",
"primary_event": true,
"shared_drive_id": "1234567890",
"team_drive_id": "1234567890",
"visibility": "shared_internally"
},
"type": "acl_change"
}
Detection logic
Condition
name eq "change_owner"
parameters.visibility not in ["shared_internally", "people_within_domain_with_link", "private"]
This rule also runs imperative logic the parser cannot express as a filter; the conditions above are the structured part it could extract.
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
parameters.visibility | in | people_within_domain_with_link, private, shared_internally |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
name | eq |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
email | actor.email |
owner | parameters.owner |
new_owner | parameters.new_owner |