Detection rules › Panther

GSuite Drive Many Documents Deleted

Status
Experimental
Severity
medium
Group by
actor.email
Log types
GSuite.ActivityEvent
Tags
GSuite, Impact, Data Destruction
Reference
https://support.google.com/drive/answer/2375102
Source
github.com/panther-labs/panther-analysis

Detects when a user moves more than 10 distinct documents to the trash in Google Drive within 60 minutes. This may indicate accidental or malicious bulk deletion of files.

MITRE ATT&CK coverage

TacticTechniques
ImpactT1485 Data Destruction

Rule body yaml

AnalysisType: rule
Filename: gsuite_drive_many_docs_deleted.py
RuleID: "GSuite.Drive.BulkDocumentDeletion"
DisplayName: "GSuite Drive Many Documents Deleted"
Status: Experimental
Enabled: true
Severity: Medium
DedupPeriodMinutes: 60
Threshold: 11
LogTypes:
  - GSuite.ActivityEvent
Description: >
  Detects when a user moves more than 10 distinct documents to the trash in Google Drive
  within 60 minutes. This may indicate accidental or malicious bulk deletion of files.
Reference: https://support.google.com/drive/answer/2375102
Reports:
  MITRE ATT&CK:
    - TA0040:T1485
Tags:
  - GSuite
  - Impact
  - Data Destruction
Runbook: |
  1. Query GSuite.ActivityEvent for all trash events by actor:email in the 2 hours around this alert to identify the full list of parameters:doc_title values deleted and whether they belong to shared drives
  2. Check parameters:visibility on the deleted documents to determine if externally or internally shared files were affected, and assess the business impact of the deletions
  3. Search for other suspicious drive activity by this user in the past 24 hours, including bulk downloads, sharing changes, or access to sensitive documents prior to deletion
Tests:
  - Name: Document Trashed
    ExpectedResult: true
    Log:
      name: trash
      id:
        applicationName: drive
      actor:
        email: user@example.com
      parameters:
        doc_id: "1ABC123def456GHI789jkl"
        doc_title: "Q4 Financial Report"
        doc_type: spreadsheet
        visibility: shared_internally
  - Name: Externally Shared Document Trashed - High Severity
    ExpectedResult: true
    Log:
      name: trash
      id:
        applicationName: drive
      actor:
        email: user@example.com
      parameters:
        doc_id: "1XYZ987uvw654MNO321pqr"
        doc_title: "Partner Contract"
        doc_type: document
        visibility: shared_externally
  - Name: Document Viewed - Not Deletion
    ExpectedResult: false
    Log:
      name: view
      id:
        applicationName: drive
      actor:
        email: user@example.com
      parameters:
        doc_title: "Q4 Financial Report"
        doc_type: spreadsheet
  - Name: Document Downloaded - Not Deletion
    ExpectedResult: false
    Log:
      name: download
      id:
        applicationName: drive
      actor:
        email: user@example.com
      parameters:
        doc_title: "Q4 Financial Report"
        doc_type: spreadsheet
  - Name: Gmail Trash - Not Drive
    ExpectedResult: false
    Log:
      name: trash
      id:
        applicationName: gmail
      actor:
        email: user@example.com

Detection logic

Condition

id.applicationName eq "drive"
name eq "trash"

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
id.applicationNameeq
  • drive
nameeq
  • trash

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
useractor.email
doc_titleparameters.doc_title
doc_typeparameters.doc_type
visibilityparameters.visibility