Elastic Security Detection Rules

Google Drive Ownership Transferred via Google Workspace

Last updated 2 months ago on 2024-09-23
Created 2 years ago on 2022-08-24

About

Drive and Docs is a Google Workspace service that allows users to leverage Google Drive and Google Docs. Access to files is based on inherited permissions from the child organizational unit the user belongs to which is scoped by administrators. Typically if a user is removed, their files can be transferred to another user by the administrator. This service can also be abused by adversaries to transfer files to an adversary account for potential exfiltration.
Tags
Domain: CloudData Source: Google WorkspaceTactic: Collection
Severity
medium
Risk Score
47
MITRE ATT&CK™

Collection (TA0009)(opens in a new tab or window)

↳ Data Staged (T1074)(opens in a new tab or window)

False Positive Examples
Administrators may transfer file ownership during employee leave or absence to ensure continued operations by a new or existing employee.
License
Elastic License v2(opens in a new tab or window)

Definition

Rule Type
Query (Kibana Query Language)
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
filebeat-*logs-google_workspace*
Related Integrations

google_workspace(opens in a new tab or window)

Query
event.dataset:"google_workspace.admin" and event.action:"CREATE_DATA_TRANSFER_REQUEST"
  and event.category:"iam" and google_workspace.admin.application.name:Drive*

Install detection rules in Elastic Security

Detect Google Drive Ownership Transferred via Google Workspace in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(opens in a new tab or window).