Detection rules › Panther
GSuite Overly Visible Drive Document
A Google drive resource that is overly visible has been modified.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Collection | T1213 Data from Information Repositories |
Rule body yaml
AnalysisType: rule
Filename: gsuite_drive_overly_visible.py
RuleID: "GSuite.DriveOverlyVisible"
DisplayName: "GSuite Overly Visible Drive Document"
Enabled: true
LogTypes:
- GSuite.ActivityEvent
Tags:
- GSuite
- Collection:Data from Information Repositories
Reports:
MITRE ATT&CK:
- TA0009:T1213
Severity: Info
Description: >
A Google drive resource that is overly visible has been modified.
Reference: https://support.google.com/docs/answer/2494822?hl=en&co=GENIE.Platform%3DDesktop&sjid=864417124752637253-EU
Runbook: >
Investigate whether the drive document is appropriate to be this visible.
SummaryAttributes:
- actor:email
DedupPeriodMinutes: 360 # 6 hours
Tests:
- Name: Access Event
ExpectedResult: false
Log:
{
"p_log_type": "GSuite.ActivityEvent",
"p_row_id": "111222",
"actor": {
"email": "bobert@example.com"
},
"id": {
"applicationName": "drive"
},
"type": "access",
"name": "download"
}
- Name: Modify Event Without Over Visibility
ExpectedResult: false
Log:
{
"p_log_type": "GSuite.ActivityEvent",
"p_row_id": "111222",
"actor": {
"email": "bobert@example.com"
},
"id": {
"applicationName": "drive"
},
"type": "access",
"name": "edit",
"parameters": {
"visibility": "private"
}
}
- Name: Overly Visible Doc Modified
ExpectedResult: true
Log:
{
"p_log_type": "GSuite.ActivityEvent",
"p_row_id": "111222",
"actor": {
"email": "bobert@example.com"
},
"id": {
"applicationName": "drive"
},
"type": "access",
"name": "edit",
"parameters": {
"visibility": "people_with_link",
"doc_title": "my shared document"
}
}
- Name: Overly Visible Doc Modified - no email
ExpectedResult: true
Log:
{
"p_log_type": "GSuite.ActivityEvent",
"p_row_id": "111222",
"actor": {
"profileId": "1234567890123"
},
"id": {
"applicationName": "drive"
},
"type": "access",
"name": "edit",
"parameters": {
"visibility": "people_with_link",
"doc_title": "my shared document"
}
}
Detection logic
Condition
id.applicationName eq "drive"
This rule also runs imperative logic the parser cannot express as a filter; the conditions above are the structured part it could extract.
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
id.applicationName | eq |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
profileId | actor.profileId |