Detection rules › Panther
GSuite Drive Many Documents Deleted
Detects when a user moves more than 10 distinct documents to the trash in Google Drive within 60 minutes. This may indicate accidental or malicious bulk deletion of files.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Impact | T1485 Data Destruction |
Rule body yaml
AnalysisType: rule
Filename: gsuite_drive_many_docs_deleted.py
RuleID: "GSuite.Drive.BulkDocumentDeletion"
DisplayName: "GSuite Drive Many Documents Deleted"
Status: Experimental
Enabled: true
Severity: Medium
DedupPeriodMinutes: 60
Threshold: 11
LogTypes:
- GSuite.ActivityEvent
Description: >
Detects when a user moves more than 10 distinct documents to the trash in Google Drive
within 60 minutes. This may indicate accidental or malicious bulk deletion of files.
Reference: https://support.google.com/drive/answer/2375102
Reports:
MITRE ATT&CK:
- TA0040:T1485
Tags:
- GSuite
- Impact
- Data Destruction
Runbook: |
1. Query GSuite.ActivityEvent for all trash events by actor:email in the 2 hours around this alert to identify the full list of parameters:doc_title values deleted and whether they belong to shared drives
2. Check parameters:visibility on the deleted documents to determine if externally or internally shared files were affected, and assess the business impact of the deletions
3. Search for other suspicious drive activity by this user in the past 24 hours, including bulk downloads, sharing changes, or access to sensitive documents prior to deletion
Tests:
- Name: Document Trashed
ExpectedResult: true
Log:
name: trash
id:
applicationName: drive
actor:
email: user@example.com
parameters:
doc_id: "1ABC123def456GHI789jkl"
doc_title: "Q4 Financial Report"
doc_type: spreadsheet
visibility: shared_internally
- Name: Externally Shared Document Trashed - High Severity
ExpectedResult: true
Log:
name: trash
id:
applicationName: drive
actor:
email: user@example.com
parameters:
doc_id: "1XYZ987uvw654MNO321pqr"
doc_title: "Partner Contract"
doc_type: document
visibility: shared_externally
- Name: Document Viewed - Not Deletion
ExpectedResult: false
Log:
name: view
id:
applicationName: drive
actor:
email: user@example.com
parameters:
doc_title: "Q4 Financial Report"
doc_type: spreadsheet
- Name: Document Downloaded - Not Deletion
ExpectedResult: false
Log:
name: download
id:
applicationName: drive
actor:
email: user@example.com
parameters:
doc_title: "Q4 Financial Report"
doc_type: spreadsheet
- Name: Gmail Trash - Not Drive
ExpectedResult: false
Log:
name: trash
id:
applicationName: gmail
actor:
email: user@example.com
Detection logic
Condition
id.applicationName eq "drive"
name eq "trash"
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
id.applicationName | eq |
|
name | eq |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
user | actor.email |
doc_title | parameters.doc_title |
doc_type | parameters.doc_type |
visibility | parameters.visibility |