Drive

eventName	Description	Sample	Rule
any	Source-only rules that filter on applicationName 'drive' without specifying an eventName attribute here.	N	Y
change_acl_editors	The editor access-control list for a Drive file was changed.	Y	Y
change_document_access_scope	The access scope of a Drive document was changed (e.g. from private to shared).	Y	Y
change_document_visibility	The visibility setting of a Drive document was changed.	Y	Y
change_user_access	A user's access to a Drive file was changed.	Y	Y
copy	A Drive file was copied.	Y	Y
delete	A Drive file was permanently deleted.	Y	Y
download	A Drive file was downloaded.	Y	Y
email_as_attachment	A Drive file was sent as an email attachment.	N	Y
source_copy	A Drive file was copied from an external source.	Y	Y
trash	A Drive file was moved to trash.	Y	Y
view	A Drive file was viewed.	Y	Y
create	A new file or folder was created in Drive.	Y	N
edit	A Drive file was edited.	Y	N
rename	A Drive file or folder was renamed.	Y	N
move	A Drive file or folder was moved to a different location.	N	N
upload	A file was uploaded to Drive.	N	N
print	A Drive file was printed.	N	N
request_access	A user requested access to a Drive file they do not have permission to view.	N	N
deny_access_request	An access request to a Drive file was denied.	N	N
add_to_folder	A Drive file was added to a folder.	Y	N
change_owner	A Drive document changed owners.	N	Y

any: Drive (any event)

ApplicationName: drive

Description

Source-only rules that filter on applicationName 'drive' without specifying an eventName attribute here.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`id.applicationName`	2 detection rules	Panther
`email`	1 detection rule	Splunk
`parameters.doc_title`	1 detection rule	Splunk
`parameters.doc_type`	1 detection rule	Splunk
`parameters.old_visibility`	1 detection rule	Panther
`parameters.owner_is_team_drive`	1 detection rule	Splunk
`parameters.visibility`	1 detection rule	Panther
`type`	1 detection rule	Panther

Common Indicators #

Positive field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

Field	Kind	Value	Rules	Vendors
`dest_domain` (splunk rule field)	eq	`internal_test_email.com`	1 rule	splunk
`type` (panther rule field)	eq	`acl_change`	1 rule	panther

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Splunk #

Gsuite Drive Share In External Email source application-level: The following analytic detects Google Drive or Google Docs files shared externally from an internal domain. It leverages GSuite Drive logs, extracting and comparing the source and destination email domains to identify external sharing.…T1567, T1567.002
Gsuite Suspicious Shared File Name source application-level: The following analytic detects shared files in Google Drive with suspicious filenames commonly used in spear phishing campaigns. It leverages GSuite Drive logs to identify documents with titles that include keywords like "dhl," "ups,"…T1566, T1566.001

Panther #

External GSuite File Share source high application-level: An employee shared a sensitive file externally with another organizationT1213
GSuite Overly Visible Drive Document source informational application-level: A Google drive resource that is overly visible has been modified.T1213

References #

Reports API: drive activity events

change_acl_editors: Change ACL Editors

ApplicationName: drive

Description

The editor access-control list for a Drive file was changed.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`target.resource.attribute.labels["visibility"]`	1 detection rule	YARA-L
`target.user.email_addresses`	1 detection rule	YARA-L

Example Audit Activity #

{
  "kind": "admin#reports#activity",
  "id": {
    "time": "2026-06-29T17:29:10.609Z",
    "uniqueQualifier": "-8471868874236111509",
    "applicationName": "drive",
    "customerId": "C00000000"
  },
  "etag": "\"3Uy7N2fsLO-UJLJooEizV70OrVTg5GdiS5meIFM6OVQ/NKGoesMHokFIKZxc8jFRFVkdaQs\"",
  "actor": {
    "email": "user@example.com",
    "profileId": "100000000000000000000",
    "applicationInfo": {
      "oauthClientId": "000000000000-00000000000000000000000000000000.apps.googleusercontent.com",
      "applicationName": "dw-capture-client",
      "impersonation": false
    }
  },
  "ipAddress": "203.0.113.10",
  "networkInfo": {
    "ipAsn": [
      64512
    ],
    "regionCode": "US",
    "subdivisionCode": "US-XX"
  },
  "events": [
    {
      "type": "access",
      "name": "create",
      "parameters": [
        {
          "name": "encryption_enforcement_option",
          "value": "disabled"
        },
        {
          "name": "primary_event",
          "boolValue": true
        },
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "user@example.com"
        },
        {
          "name": "doc_id",
          "value": "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
        },
        {
          "name": "doc_type",
          "value": "document"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "DW Copied Doc"
        },
        {
          "name": "visibility",
          "value": "private"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ],
      "resourceIds": [
        "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
      ]
    },
    {
      "type": "acl_change",
      "name": "change_user_access",
      "parameters": [
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "visibility_change",
          "value": "none"
        },
        {
          "name": "target_user",
          "value": "user@example.com"
        },
        {
          "name": "old_value",
          "multiValue": [
            "none"
          ]
        },
        {
          "name": "new_value",
          "multiValue": [
            "owner"
          ]
        },
        {
          "name": "old_visibility",
          "value": "unknown"
        },
        {
          "name": "primary_event",
          "boolValue": false
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "user@example.com"
        },
        {
          "name": "doc_id",
          "value": "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
        },
        {
          "name": "doc_type",
          "value": "document"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "DW Copied Doc"
        },
        {
          "name": "visibility",
          "value": "private"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ],
      "resourceIds": [
        "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
      ]
    },
    {
      "type": "acl_change",
      "name": "change_acl_editors",
      "parameters": [
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "visibility_change",
          "value": "none"
        },
        {
          "name": "old_value",
          "multiValue": [
            "owner"
          ]
        },
        {
          "name": "new_value",
          "multiValue": [
            "owner",
            "writers"
          ]
        },
        {
          "name": "old_visibility",
          "value": "unknown"
        },
        {
          "name": "primary_event",
          "boolValue": false
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "user@example.com"
        },
        {
          "name": "doc_id",
          "value": "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
        },
        {
          "name": "doc_type",
          "value": "document"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "DW Copied Doc"
        },
        {
          "name": "visibility",
          "value": "private"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ],
      "resourceIds": [
        "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
      ]
    },
    {
      "type": "access",
      "name": "add_to_folder",
      "parameters": [
        {
          "name": "destination_folder_title",
          "multiValue": [
            "Root"
          ]
        },
        {
          "name": "destination_folder_id",
          "multiValue": [
            "0ADCh7zD0vl6sUk9PVA"
          ]
        },
        {
          "name": "primary_event",
          "boolValue": false
        },
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "user@example.com"
        },
        {
          "name": "doc_id",
          "value": "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
        },
        {
          "name": "doc_type",
          "value": "document"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "DW Copied Doc"
        },
        {
          "name": "visibility",
          "value": "private"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ],
      "resourceIds": [
        "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
      ]
    },
    {
      "type": "access",
      "name": "copy",
      "parameters": [
        {
          "name": "copy_type",
          "value": "internal"
        },
        {
          "name": "old_value",
          "multiValue": [
            "DW Source Doc"
          ]
        },
        {
          "name": "new_value",
          "multiValue": [
            "DW Copied Doc"
          ]
        },
        {
          "name": "primary_event",
          "boolValue": true
        },
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "user@example.com"
        },
        {
          "name": "doc_id",
          "value": "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
        },
        {
          "name": "doc_type",
          "value": "document"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "DW Copied Doc"
        },
        {
          "name": "visibility",
          "value": "private"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ],
      "resourceIds": [
        "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
      ]
    }
  ],
  "resourceDetails": [
    {
      "id": "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0",
      "title": "DW Copied Doc",
      "type": "DRIVE_ITEM",
      "relation": "DRIVE_PRIMARY",
      "ownerDetails": {
        "ownerType": "USER",
        "ownerIdentity": [
          {
            "userIdentity": {
              "id": "2pta16n23k0tb9",
              "userEmail": "user@example.com"
            }
          }
        ]
      }
    }
  ]
}

Common Indicators #

Field	Kind	Value	Rules	Vendors
`about.labels["is_suspicious"] (Chronicle)`	eq	`true`	1 rule	chronicle
`target.user.email_addresses (Chronicle)`	regex_match	`.@gmail\.com\|.@aol\.com\|.@ymail\.com\|.@ymail\.com\|.@hotmail\.com\|.@outlook\.com\|.*@icloud\.com`	1 rule	chronicle

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

YARA-L #

Google Workspace File Shared From Google Drive To Free Email Domain source high: Identifies when a user shares a file on Google Drive with a free email domain, which may indicate data exfiltration.T1567↳ also matches change_document_access_scope: Change Document Access Scope, change_document_visibility: Change Document Visibility, change_user_access: Change User Access
Google Workspace Suspicious Login and Google Drive File Share source high: Identifies when a Google Workspace user shares a file on Google Drive after a suspicious login event occurred.T1567↳ also matches change_document_access_scope: Change Document Access Scope, change_document_visibility: Change Document Visibility, change_user_access: Change User Access

References #

Drive Activity Events: change_acl_editors

change_document_access_scope: Change Document Access Scope

ApplicationName: drive

Description

The access scope of a Drive document was changed (e.g. from private to shared).

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`target.resource.attribute.labels["visibility"]`	1 detection rule	YARA-L
`target.user.email_addresses`	1 detection rule	YARA-L

Example Audit Activity #

{
  "kind": "admin#reports#activity",
  "id": {
    "time": "2022-08-02T07:12:16.443Z",
    "uniqueQualifier": "7993207407367181217",
    "applicationName": "drive",
    "customerId": "C00mpaiwz"
  },
  "etag": "\"_ZVRqe-BUDYcYeOIPo-gm6Eh1QaGne4ACjHHI6qsr6A/vP0xdiLQj3NYg42e0keMg64GtJk\"",
  "actor": {
    "email": "workspace@cloud-response.com",
    "profileId": "102509620547980436027"
  },
  "ipAddress": "31.171.152.13",
  "events": [
    {
      "type": "access",
      "name": "edit",
      "parameters": [
        {
          "name": "primary_event",
          "boolValue": false
        },
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "doc_id",
          "value": "1jrs7AguRkIhxhC3_-_Kgrd9axXugK7k7uySILb5YG3E"
        },
        {
          "name": "doc_type",
          "value": "document"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "Plan for world domination"
        },
        {
          "name": "visibility",
          "value": "people_with_link"
        },
        {
          "name": "originating_app_id",
          "value": "211604355607"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "workspace@cloud-response.com"
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ]
    },
    {
      "type": "acl_change",
      "name": "change_document_visibility",
      "parameters": [
        {
          "name": "primary_event",
          "boolValue": true
        },
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "visibility_change",
          "value": "external"
        },
        {
          "name": "target_domain",
          "value": "all"
        },
        {
          "name": "old_value",
          "multiValue": [
            "private"
          ]
        },
        {
          "name": "new_value",
          "multiValue": [
            "people_with_link"
          ]
        },
        {
          "name": "old_visibility",
          "value": "private"
        },
        {
          "name": "doc_id",
          "value": "1jrs7AguRkIhxhC3_-_Kgrd9axXugK7k7uySILb5YG3E"
        },
        {
          "name": "doc_type",
          "value": "document"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "Plan for world domination"
        },
        {
          "name": "visibility",
          "value": "people_with_link"
        },
        {
          "name": "originating_app_id",
          "value": "211604355607"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "workspace@cloud-response.com"
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ]
    },
    {
      "type": "acl_change",
      "name": "change_document_access_scope",
      "parameters": [
        {
          "name": "primary_event",
          "boolValue": true
        },
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "visibility_change",
          "value": "external"
        },
        {
          "name": "target_domain",
          "value": "all"
        },
        {
          "name": "old_value",
          "multiValue": [
            "none"
          ]
        },
        {
          "name": "new_value",
          "multiValue": [
            "can_view"
          ]
        },
        {
          "name": "old_visibility",
          "value": "private"
        },
        {
          "name": "doc_id",
          "value": "1jrs7AguRkIhxhC3_-_Kgrd9axXugK7k7uySILb5YG3E"
        },
        {
          "name": "doc_type",
          "value": "document"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "Plan for world domination"
        },
        {
          "name": "visibility",
          "value": "people_with_link"
        },
        {
          "name": "originating_app_id",
          "value": "211604355607"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "workspace@cloud-response.com"
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ]
    }
  ]
}

Common Indicators #

Field	Kind	Value	Rules	Vendors
`about.labels["is_suspicious"] (Chronicle)`	eq	`true`	1 rule	chronicle
`target.user.email_addresses (Chronicle)`	regex_match	`.@gmail\.com\|.@aol\.com\|.@ymail\.com\|.@ymail\.com\|.@hotmail\.com\|.@outlook\.com\|.*@icloud\.com`	1 rule	chronicle

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

YARA-L #

Google Workspace File Shared From Google Drive To Free Email Domain source high: Identifies when a user shares a file on Google Drive with a free email domain, which may indicate data exfiltration.T1567↳ also matches change_acl_editors: Change ACL Editors, change_document_visibility: Change Document Visibility, change_user_access: Change User Access
Google Workspace Suspicious Login and Google Drive File Share source high: Identifies when a Google Workspace user shares a file on Google Drive after a suspicious login event occurred.T1567↳ also matches change_acl_editors: Change ACL Editors, change_document_visibility: Change Document Visibility, change_user_access: Change User Access

References #

change_document_visibility: Change Document Visibility

ApplicationName: drive

Description

The visibility setting of a Drive document was changed.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`id.applicationName`	1 detection rule	Panther
`name`	1 detection rule	Panther
`target.resource.attribute.labels["visibility"]`	1 detection rule	YARA-L
`target.user.email_addresses`	1 detection rule	YARA-L
`type`	1 detection rule	Panther

Example Audit Activity #

{
  "kind": "admin#reports#activity",
  "id": {
    "time": "2022-08-02T07:12:16.443Z",
    "uniqueQualifier": "7993207407367181217",
    "applicationName": "drive",
    "customerId": "C00mpaiwz"
  },
  "etag": "\"_ZVRqe-BUDYcYeOIPo-gm6Eh1QaGne4ACjHHI6qsr6A/vP0xdiLQj3NYg42e0keMg64GtJk\"",
  "actor": {
    "email": "workspace@cloud-response.com",
    "profileId": "102509620547980436027"
  },
  "ipAddress": "31.171.152.13",
  "events": [
    {
      "type": "access",
      "name": "edit",
      "parameters": [
        {
          "name": "primary_event",
          "boolValue": false
        },
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "doc_id",
          "value": "1jrs7AguRkIhxhC3_-_Kgrd9axXugK7k7uySILb5YG3E"
        },
        {
          "name": "doc_type",
          "value": "document"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "Plan for world domination"
        },
        {
          "name": "visibility",
          "value": "people_with_link"
        },
        {
          "name": "originating_app_id",
          "value": "211604355607"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "workspace@cloud-response.com"
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ]
    },
    {
      "type": "acl_change",
      "name": "change_document_visibility",
      "parameters": [
        {
          "name": "primary_event",
          "boolValue": true
        },
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "visibility_change",
          "value": "external"
        },
        {
          "name": "target_domain",
          "value": "all"
        },
        {
          "name": "old_value",
          "multiValue": [
            "private"
          ]
        },
        {
          "name": "new_value",
          "multiValue": [
            "people_with_link"
          ]
        },
        {
          "name": "old_visibility",
          "value": "private"
        },
        {
          "name": "doc_id",
          "value": "1jrs7AguRkIhxhC3_-_Kgrd9axXugK7k7uySILb5YG3E"
        },
        {
          "name": "doc_type",
          "value": "document"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "Plan for world domination"
        },
        {
          "name": "visibility",
          "value": "people_with_link"
        },
        {
          "name": "originating_app_id",
          "value": "211604355607"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "workspace@cloud-response.com"
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ]
    },
    {
      "type": "acl_change",
      "name": "change_document_access_scope",
      "parameters": [
        {
          "name": "primary_event",
          "boolValue": true
        },
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "visibility_change",
          "value": "external"
        },
        {
          "name": "target_domain",
          "value": "all"
        },
        {
          "name": "old_value",
          "multiValue": [
            "none"
          ]
        },
        {
          "name": "new_value",
          "multiValue": [
            "can_view"
          ]
        },
        {
          "name": "old_visibility",
          "value": "private"
        },
        {
          "name": "doc_id",
          "value": "1jrs7AguRkIhxhC3_-_Kgrd9axXugK7k7uySILb5YG3E"
        },
        {
          "name": "doc_type",
          "value": "document"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "Plan for world domination"
        },
        {
          "name": "visibility",
          "value": "people_with_link"
        },
        {
          "name": "originating_app_id",
          "value": "211604355607"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "workspace@cloud-response.com"
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ]
    }
  ]
}

Common Indicators #

Field	Kind	Value	Rules	Vendors
`about.labels["is_suspicious"] (Chronicle)`	eq	`true`	1 rule	chronicle
`target.user.email_addresses (Chronicle)`	regex_match	`.@gmail\.com\|.@aol\.com\|.@ymail\.com\|.@ymail\.com\|.@hotmail\.com\|.@outlook\.com\|.*@icloud\.com`	1 rule	chronicle
`type` (panther rule field)	eq	`acl_change`	1 rule	panther

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

YARA-L #

Google Workspace File Shared From Google Drive To Free Email Domain source high: Identifies when a user shares a file on Google Drive with a free email domain, which may indicate data exfiltration.T1567↳ also matches change_acl_editors: Change ACL Editors, change_document_access_scope: Change Document Access Scope, change_user_access: Change User Access
Google Workspace Suspicious Login and Google Drive File Share source high: Identifies when a Google Workspace user shares a file on Google Drive after a suspicious login event occurred.T1567↳ also matches change_acl_editors: Change ACL Editors, change_document_access_scope: Change Document Access Scope, change_user_access: Change User Access

Panther #

GSuite External Drive Document source low: A Google drive resource became externally accessible.T1213↳ also matches change_user_access: Change User Access

References #

change_user_access: Change User Access

ApplicationName: drive

Description

A user's access to a Drive file was changed.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`email`	1 detection rule	Splunk
`EventMessage`	1 detection rule	Kusto
`id.applicationName`	1 detection rule	Panther
`name`	1 detection rule	Panther
`name`	1 detection rule	Splunk
`target.resource.attribute.labels["visibility"]`	1 detection rule	YARA-L
`target.user.email_addresses`	1 detection rule	YARA-L
`target_user`	1 detection rule	Splunk
`type`	1 detection rule	Panther

Example Audit Activity #

{
  "kind": "admin#reports#activity",
  "id": {
    "time": "2026-06-29T17:29:10.609Z",
    "uniqueQualifier": "-8471868874236111509",
    "applicationName": "drive",
    "customerId": "C00000000"
  },
  "etag": "\"3Uy7N2fsLO-UJLJooEizV70OrVTg5GdiS5meIFM6OVQ/NKGoesMHokFIKZxc8jFRFVkdaQs\"",
  "actor": {
    "email": "user@example.com",
    "profileId": "100000000000000000000",
    "applicationInfo": {
      "oauthClientId": "000000000000-00000000000000000000000000000000.apps.googleusercontent.com",
      "applicationName": "dw-capture-client",
      "impersonation": false
    }
  },
  "ipAddress": "203.0.113.10",
  "networkInfo": {
    "ipAsn": [
      64512
    ],
    "regionCode": "US",
    "subdivisionCode": "US-XX"
  },
  "events": [
    {
      "type": "access",
      "name": "create",
      "parameters": [
        {
          "name": "encryption_enforcement_option",
          "value": "disabled"
        },
        {
          "name": "primary_event",
          "boolValue": true
        },
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "user@example.com"
        },
        {
          "name": "doc_id",
          "value": "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
        },
        {
          "name": "doc_type",
          "value": "document"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "DW Copied Doc"
        },
        {
          "name": "visibility",
          "value": "private"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ],
      "resourceIds": [
        "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
      ]
    },
    {
      "type": "acl_change",
      "name": "change_user_access",
      "parameters": [
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "visibility_change",
          "value": "none"
        },
        {
          "name": "target_user",
          "value": "user@example.com"
        },
        {
          "name": "old_value",
          "multiValue": [
            "none"
          ]
        },
        {
          "name": "new_value",
          "multiValue": [
            "owner"
          ]
        },
        {
          "name": "old_visibility",
          "value": "unknown"
        },
        {
          "name": "primary_event",
          "boolValue": false
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "user@example.com"
        },
        {
          "name": "doc_id",
          "value": "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
        },
        {
          "name": "doc_type",
          "value": "document"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "DW Copied Doc"
        },
        {
          "name": "visibility",
          "value": "private"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ],
      "resourceIds": [
        "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
      ]
    },
    {
      "type": "acl_change",
      "name": "change_acl_editors",
      "parameters": [
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "visibility_change",
          "value": "none"
        },
        {
          "name": "old_value",
          "multiValue": [
            "owner"
          ]
        },
        {
          "name": "new_value",
          "multiValue": [
            "owner",
            "writers"
          ]
        },
        {
          "name": "old_visibility",
          "value": "unknown"
        },
        {
          "name": "primary_event",
          "boolValue": false
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "user@example.com"
        },
        {
          "name": "doc_id",
          "value": "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
        },
        {
          "name": "doc_type",
          "value": "document"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "DW Copied Doc"
        },
        {
          "name": "visibility",
          "value": "private"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ],
      "resourceIds": [
        "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
      ]
    },
    {
      "type": "access",
      "name": "add_to_folder",
      "parameters": [
        {
          "name": "destination_folder_title",
          "multiValue": [
            "Root"
          ]
        },
        {
          "name": "destination_folder_id",
          "multiValue": [
            "0ADCh7zD0vl6sUk9PVA"
          ]
        },
        {
          "name": "primary_event",
          "boolValue": false
        },
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "user@example.com"
        },
        {
          "name": "doc_id",
          "value": "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
        },
        {
          "name": "doc_type",
          "value": "document"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "DW Copied Doc"
        },
        {
          "name": "visibility",
          "value": "private"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ],
      "resourceIds": [
        "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
      ]
    },
    {
      "type": "access",
      "name": "copy",
      "parameters": [
        {
          "name": "copy_type",
          "value": "internal"
        },
        {
          "name": "old_value",
          "multiValue": [
            "DW Source Doc"
          ]
        },
        {
          "name": "new_value",
          "multiValue": [
            "DW Copied Doc"
          ]
        },
        {
          "name": "primary_event",
          "boolValue": true
        },
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "user@example.com"
        },
        {
          "name": "doc_id",
          "value": "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
        },
        {
          "name": "doc_type",
          "value": "document"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "DW Copied Doc"
        },
        {
          "name": "visibility",
          "value": "private"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ],
      "resourceIds": [
        "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
      ]
    }
  ],
  "resourceDetails": [
    {
      "id": "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0",
      "title": "DW Copied Doc",
      "type": "DRIVE_ITEM",
      "relation": "DRIVE_PRIMARY",
      "ownerDetails": {
        "ownerType": "USER",
        "ownerIdentity": [
          {
            "userIdentity": {
              "id": "2pta16n23k0tb9",
              "userEmail": "user@example.com"
            }
          }
        ]
      }
    }
  ]
}

Common Indicators #

Field	Kind	Value	Rules	Vendors
`about.labels["is_suspicious"] (Chronicle)`	eq	`true`	1 rule	chronicle
`target.user.email_addresses (Chronicle)`	regex_match	`.@gmail\.com\|.@aol\.com\|.@ymail\.com\|.@ymail\.com\|.@hotmail\.com\|.@outlook\.com\|.*@icloud\.com`	1 rule	chronicle
`type` (panther rule field)	eq	`acl_change`	1 rule	panther

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Splunk #

Gdrive suspicious file sharing source: The following analytic identifies suspicious file-sharing activity on Google Drive, where internal users share documents with more than 50 external recipients. It leverages GSuite Drive logs, focusing on changes in user access and…T1566

References #

Drive Activity Events: change_user_access

copy: Copy

ApplicationName: drive

Description

A Drive file was copied.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`event.action`	2 detection rules	Elastic
`target.resource.attribute.labels["visibility"]`	2 detection rules	YARA-L
`target.resource.name`	2 detection rules	YARA-L
`file.extension`	1 detection rule	Elastic
`google_workspace.drive.copy_type`	1 detection rule	Elastic
`google_workspace.drive.file.type`	1 detection rule	Elastic
`google_workspace.drive.owner_is_team_drive`	1 detection rule	Elastic
`google_workspace.drive.visibility`	1 detection rule	Elastic
`source.user.email`	1 detection rule	Elastic

Example Audit Activity #

{
  "kind": "admin#reports#activity",
  "id": {
    "time": "2026-06-29T17:29:10.609Z",
    "uniqueQualifier": "-8471868874236111509",
    "applicationName": "drive",
    "customerId": "C00000000"
  },
  "etag": "\"3Uy7N2fsLO-UJLJooEizV70OrVTg5GdiS5meIFM6OVQ/NKGoesMHokFIKZxc8jFRFVkdaQs\"",
  "actor": {
    "email": "user@example.com",
    "profileId": "100000000000000000000",
    "applicationInfo": {
      "oauthClientId": "000000000000-00000000000000000000000000000000.apps.googleusercontent.com",
      "applicationName": "dw-capture-client",
      "impersonation": false
    }
  },
  "ipAddress": "203.0.113.10",
  "networkInfo": {
    "ipAsn": [
      64512
    ],
    "regionCode": "US",
    "subdivisionCode": "US-XX"
  },
  "events": [
    {
      "type": "access",
      "name": "create",
      "parameters": [
        {
          "name": "encryption_enforcement_option",
          "value": "disabled"
        },
        {
          "name": "primary_event",
          "boolValue": true
        },
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "user@example.com"
        },
        {
          "name": "doc_id",
          "value": "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
        },
        {
          "name": "doc_type",
          "value": "document"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "DW Copied Doc"
        },
        {
          "name": "visibility",
          "value": "private"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ],
      "resourceIds": [
        "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
      ]
    },
    {
      "type": "acl_change",
      "name": "change_user_access",
      "parameters": [
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "visibility_change",
          "value": "none"
        },
        {
          "name": "target_user",
          "value": "user@example.com"
        },
        {
          "name": "old_value",
          "multiValue": [
            "none"
          ]
        },
        {
          "name": "new_value",
          "multiValue": [
            "owner"
          ]
        },
        {
          "name": "old_visibility",
          "value": "unknown"
        },
        {
          "name": "primary_event",
          "boolValue": false
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "user@example.com"
        },
        {
          "name": "doc_id",
          "value": "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
        },
        {
          "name": "doc_type",
          "value": "document"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "DW Copied Doc"
        },
        {
          "name": "visibility",
          "value": "private"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ],
      "resourceIds": [
        "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
      ]
    },
    {
      "type": "acl_change",
      "name": "change_acl_editors",
      "parameters": [
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "visibility_change",
          "value": "none"
        },
        {
          "name": "old_value",
          "multiValue": [
            "owner"
          ]
        },
        {
          "name": "new_value",
          "multiValue": [
            "owner",
            "writers"
          ]
        },
        {
          "name": "old_visibility",
          "value": "unknown"
        },
        {
          "name": "primary_event",
          "boolValue": false
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "user@example.com"
        },
        {
          "name": "doc_id",
          "value": "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
        },
        {
          "name": "doc_type",
          "value": "document"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "DW Copied Doc"
        },
        {
          "name": "visibility",
          "value": "private"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ],
      "resourceIds": [
        "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
      ]
    },
    {
      "type": "access",
      "name": "add_to_folder",
      "parameters": [
        {
          "name": "destination_folder_title",
          "multiValue": [
            "Root"
          ]
        },
        {
          "name": "destination_folder_id",
          "multiValue": [
            "0ADCh7zD0vl6sUk9PVA"
          ]
        },
        {
          "name": "primary_event",
          "boolValue": false
        },
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "user@example.com"
        },
        {
          "name": "doc_id",
          "value": "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
        },
        {
          "name": "doc_type",
          "value": "document"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "DW Copied Doc"
        },
        {
          "name": "visibility",
          "value": "private"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ],
      "resourceIds": [
        "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
      ]
    },
    {
      "type": "access",
      "name": "copy",
      "parameters": [
        {
          "name": "copy_type",
          "value": "internal"
        },
        {
          "name": "old_value",
          "multiValue": [
            "DW Source Doc"
          ]
        },
        {
          "name": "new_value",
          "multiValue": [
            "DW Copied Doc"
          ]
        },
        {
          "name": "primary_event",
          "boolValue": true
        },
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "user@example.com"
        },
        {
          "name": "doc_id",
          "value": "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
        },
        {
          "name": "doc_type",
          "value": "document"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "DW Copied Doc"
        },
        {
          "name": "visibility",
          "value": "private"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ],
      "resourceIds": [
        "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
      ]
    }
  ],
  "resourceDetails": [
    {
      "id": "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0",
      "title": "DW Copied Doc",
      "type": "DRIVE_ITEM",
      "relation": "DRIVE_PRIMARY",
      "ownerDetails": {
        "ownerType": "USER",
        "ownerIdentity": [
          {
            "userIdentity": {
              "id": "2pta16n23k0tb9",
              "userEmail": "user@example.com"
            }
          }
        ]
      }
    }
  ]
}

Common Indicators #

Field	Kind	Value	Rules	Vendors
`target.resource.attribute.labels["visibility"] (Chronicle)`	eq	`people_with_link`	2 rules	chronicle
`target.resource.attribute.labels["visibility"] (Chronicle)`	eq	`public_on_the_web`	2 rules	chronicle
`file.extension` (elastic rule field)	eq	`p7b`	1 rule	elastic
`google_workspace.token.client.id (GWS)`	ends_with	`apps.googleusercontent.com`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Google Workspace Drive Encryption Key(s) Accessed from Anonymous User source high: Detects when an anonymous user views, copies, or downloads a private key or credential file from Google Drive via an anyone-with-the-link share. Adversaries who obtain or create open Drive links can harvest encryption keys and secrets stored in user drives, then use those materials to decrypt data, authenticate to services, or expand access beyond the initial compromise.T1530, T1552, T1552.004↳ also matches download: Download, view: View
Google Workspace Object Copied from External Drive with App Consent source high: Detects when a user copies a Google document, spreadsheet, form, or script from an external Drive into their Workspace Drive and shortly after authorizes a custom Google OAuth application. Adversaries may send spearphishing links with a /copy URI parameter so the victim replicates a malicious object locally. Container-bound Apps Script can then execute on open and prompt the user for OAuth consent, granting the attacker's application access to Workspace data.T1098, T1098.001, T1204, T1204.001, T1566, T1566.002

YARA-L #

Google Workspace Encryption Key File Accessed By An Anonymous User source medium: Identifies when an encryption key file is accessed by an anonymous user in Google Drive. An adversary may attempt to access encryption keys before moving laterally and compromising sensitive data.T1552↳ also matches download: Download, view: View
Google Workspace Malicious File Downloaded source medium: Identifies when a user downloads a potentially malicious file from Google Drive.T1204↳ also matches download: Download, view: View
Google Workspace Multiple Files Copied From Google Drive source high: Identifies when a user copies multiple files from Google Drive, which may indicate data exfiltration.T1567↳ also matches source_copy: Source Copy

References #

Drive Activity Events: copy

delete: Delete

ApplicationName: drive

Description

A Drive file was permanently deleted.

Example Audit Activity #

{
  "kind": "admin#reports#activity",
  "id": {
    "time": "2026-06-29T17:28:15.348Z",
    "uniqueQualifier": "5765547296531555686",
    "applicationName": "drive",
    "customerId": "C00000000"
  },
  "etag": "\"3Uy7N2fsLO-UJLJooEizV70OrVTg5GdiS5meIFM6OVQ/yXp6KmxYYMmGs_P-gKbbjIdhSHI\"",
  "actor": {
    "email": "user@example.com",
    "profileId": "100000000000000000000",
    "applicationInfo": {
      "oauthClientId": "000000000000-00000000000000000000000000000000.apps.googleusercontent.com",
      "applicationName": "dw-capture-client",
      "impersonation": false
    }
  },
  "ipAddress": "203.0.113.10",
  "networkInfo": {
    "ipAsn": [
      64512
    ],
    "regionCode": "US",
    "subdivisionCode": "US-XX"
  },
  "events": [
    {
      "type": "access",
      "name": "delete",
      "parameters": [
        {
          "name": "deletion_reason",
          "value": "individual_delete"
        },
        {
          "name": "primary_event",
          "boolValue": true
        },
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "user@example.com"
        },
        {
          "name": "doc_id",
          "value": "1Cs9t1SIsLKGI42Q1F5k4iolvQ8TAu1eN"
        },
        {
          "name": "doc_type",
          "value": "txt"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "dwprobe.txt"
        },
        {
          "name": "visibility",
          "value": "private"
        },
        {
          "name": "originating_app_id",
          "value": "000000000000"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ],
      "resourceIds": [
        "1Cs9t1SIsLKGI42Q1F5k4iolvQ8TAu1eN"
      ]
    }
  ],
  "resourceDetails": [
    {
      "id": "1Cs9t1SIsLKGI42Q1F5k4iolvQ8TAu1eN",
      "title": "dwprobe.txt",
      "type": "DRIVE_ITEM",
      "relation": "DRIVE_PRIMARY",
      "ownerDetails": {
        "ownerType": "USER",
        "ownerIdentity": [
          {
            "userIdentity": {
              "id": "2pta16n23k0tb9",
              "userEmail": "user@example.com"
            }
          }
        ]
      }
    }
  ]
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

YARA-L #

Google Workspace Multiple Files Deleted From Google Drive source high: Identifies when a user deletes multiple files from Google Drive, which may indicate data destruction.T1485↳ also matches trash: Trash

References #

Drive Activity Events: delete

download: Download

ApplicationName: drive

Description

A Drive file was downloaded.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`name`	3 detection rules	Panther
`download_count`	2 detection rules	Panther
`target.resource.attribute.labels["visibility"]`	2 detection rules	YARA-L
`target.resource.name`	2 detection rules	YARA-L
`event.action`	1 detection rule	Elastic
`file.extension`	1 detection rule	Elastic
`google_workspace.drive.visibility`	1 detection rule	Elastic
`id.applicationName`	1 detection rule	Panther
`source.user.email`	1 detection rule	Elastic

Example Audit Activity #

{
  "kind": "admin#reports#activity",
  "id": {
    "time": "2026-06-29T17:29:12.949Z",
    "uniqueQualifier": "9006240475568554118",
    "applicationName": "drive",
    "customerId": "C00000000"
  },
  "etag": "\"3Uy7N2fsLO-UJLJooEizV70OrVTg5GdiS5meIFM6OVQ/6QA-3da8TS4dtnlXy1KRel5Yqzc\"",
  "actor": {
    "email": "user@example.com",
    "profileId": "100000000000000000000",
    "applicationInfo": {
      "oauthClientId": "000000000000-00000000000000000000000000000000.apps.googleusercontent.com",
      "applicationName": "dw-capture-client",
      "impersonation": false
    }
  },
  "ipAddress": "203.0.113.10",
  "networkInfo": {
    "ipAsn": [
      64512
    ],
    "regionCode": "US",
    "subdivisionCode": "US-XX"
  },
  "events": [
    {
      "type": "access",
      "name": "download",
      "parameters": [
        {
          "name": "primary_event",
          "boolValue": true
        },
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "user@example.com"
        },
        {
          "name": "doc_id",
          "value": "1fcANDjoGwvjlghQIyc_Y-s92B_-hlmihf6rsqrYZfp4"
        },
        {
          "name": "doc_type",
          "value": "document"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "DW Source Doc"
        },
        {
          "name": "visibility",
          "value": "private"
        },
        {
          "name": "originating_app_id",
          "value": "000000000000"
        },
        {
          "name": "api_method",
          "value": "drive.files.export"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ],
      "resourceIds": [
        "1fcANDjoGwvjlghQIyc_Y-s92B_-hlmihf6rsqrYZfp4"
      ]
    }
  ],
  "resourceDetails": [
    {
      "id": "1fcANDjoGwvjlghQIyc_Y-s92B_-hlmihf6rsqrYZfp4",
      "title": "DW Source Doc",
      "type": "DRIVE_ITEM",
      "relation": "DRIVE_PRIMARY",
      "ownerDetails": {
        "ownerType": "USER",
        "ownerIdentity": [
          {
            "userIdentity": {
              "id": "2pta16n23k0tb9",
              "userEmail": "user@example.com"
            }
          }
        ]
      }
    }
  ]
}

Common Indicators #

Field	Kind	Value	Rules	Vendors
`target.resource.attribute.labels["visibility"] (Chronicle)`	eq	`people_with_link`	2 rules	chronicle
`target.resource.attribute.labels["visibility"] (Chronicle)`	eq	`public_on_the_web`	2 rules	chronicle
`about.labels["is_suspicious"] (Chronicle)`	eq	`true`	1 rule	chronicle
`download_count` (panther rule field)	gt	`10`	1 rule	panther
`file.extension` (elastic rule field)	eq	`p7b`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Google Workspace Drive Encryption Key(s) Accessed from Anonymous User source high: Detects when an anonymous user views, copies, or downloads a private key or credential file from Google Drive via an anyone-with-the-link share. Adversaries who obtain or create open Drive links can harvest encryption keys and secrets stored in user drives, then use those materials to decrypt data, authenticate to services, or expand access beyond the initial compromise.T1530, T1552, T1552.004↳ also matches copy: Copy, view: View

YARA-L #

Google Workspace Multiple Files Downloaded From Google Drive source high: Identifies when a user downloads multiple files from Google Drive, which may indicate data exfiltration.T1567
Google Workspace Suspicious Login and Google Drive File Download source high: Identifies when a Google Workspace user downloads a file from Google Drive after a suspicious login event occurred.T1567
Google Workspace Encryption Key File Accessed By An Anonymous User source medium: Identifies when an encryption key file is accessed by an anonymous user in Google Drive. An adversary may attempt to access encryption keys before moving laterally and compromising sensitive data.T1552↳ also matches copy: Copy, view: View

Show 1 more (4 total) on the rules page

Panther #

Google Workspace Many Docs Downloaded source informational: Checks whether a user has downloaded a large number of documents from Google Drive within a 5-minute period.T1567
GSuite Many Docs Downloaded Query source: Query to search high document download counts by users.
Google Drive High Download Count source medium linked query: GSuite Many Docs Downloaded Query: Scheduled rule for the High Google Drive Download Count query which looks for incidents of more than 10 (tunable) downloads by a user in the past day.

References #

Drive Activity Events: download

email_as_attachment: Email as Attachment

ApplicationName: drive

Description

A Drive file was sent as an email attachment.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`target.user.email_addresses`	1 detection rule	YARA-L

Common Indicators #

Field	Kind	Value	Rules	Vendors
`target.user.email_addresses (Chronicle)`	regex_match	`.@gmail\.com\|.@aol\.com\|.@ymail\.com\|.@ymail\.com\|.@hotmail\.com\|.@outlook\.com\|.*@icloud\.com`	1 rule	chronicle

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

YARA-L #

Google Workspace Multiple Files Sent As Email Attachments From Google Drive source high: Identifies when a user sends multiple files from Google Drive as an email attachment to a free email domain, which may indicate data exfiltration.T1567

References #

Drive Activity Events: email_as_attachment

source_copy: Source Copy

ApplicationName: drive

Description

A Drive file was copied from an external source.

Example Audit Activity #

{
  "kind": "admin#reports#activity",
  "id": {
    "time": "2026-06-29T17:29:10.609Z",
    "uniqueQualifier": "3993947426009595687",
    "applicationName": "drive",
    "customerId": "C00000000"
  },
  "etag": "\"3Uy7N2fsLO-UJLJooEizV70OrVTg5GdiS5meIFM6OVQ/T-YMUvitN7ad8rJQlzexG9Q4tVY\"",
  "actor": {
    "email": "user@example.com",
    "profileId": "100000000000000000000",
    "applicationInfo": {
      "oauthClientId": "000000000000-00000000000000000000000000000000.apps.googleusercontent.com",
      "applicationName": "dw-capture-client",
      "impersonation": false
    }
  },
  "ipAddress": "203.0.113.10",
  "networkInfo": {
    "ipAsn": [
      64512
    ],
    "regionCode": "US",
    "subdivisionCode": "US-XX"
  },
  "events": [
    {
      "type": "access",
      "name": "source_copy",
      "parameters": [
        {
          "name": "copy_type",
          "value": "internal"
        },
        {
          "name": "old_value",
          "multiValue": [
            "DW Source Doc"
          ]
        },
        {
          "name": "new_value",
          "multiValue": [
            "DW Copied Doc"
          ]
        },
        {
          "name": "primary_event",
          "boolValue": true
        },
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "user@example.com"
        },
        {
          "name": "doc_id",
          "value": "1fcANDjoGwvjlghQIyc_Y-s92B_-hlmihf6rsqrYZfp4"
        },
        {
          "name": "doc_type",
          "value": "document"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "DW Source Doc"
        },
        {
          "name": "visibility",
          "value": "private"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ],
      "resourceIds": [
        "1fcANDjoGwvjlghQIyc_Y-s92B_-hlmihf6rsqrYZfp4"
      ]
    }
  ],
  "resourceDetails": [
    {
      "id": "1fcANDjoGwvjlghQIyc_Y-s92B_-hlmihf6rsqrYZfp4",
      "title": "DW Source Doc",
      "type": "DRIVE_ITEM",
      "relation": "DRIVE_PRIMARY",
      "ownerDetails": {
        "ownerType": "USER",
        "ownerIdentity": [
          {
            "userIdentity": {
              "id": "2pta16n23k0tb9",
              "userEmail": "user@example.com"
            }
          }
        ]
      }
    }
  ]
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

YARA-L #

Google Workspace Multiple Files Copied From Google Drive source high: Identifies when a user copies multiple files from Google Drive, which may indicate data exfiltration.T1567↳ also matches copy: Copy

References #

Drive Activity Events: source_copy

trash: Trash

ApplicationName: drive

Description

A Drive file was moved to trash.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`name`	3 detection rules	Panther
`delete_count`	2 detection rules	Panther
`id.applicationName`	1 detection rule	Panther

Example Audit Activity #

{
  "kind": "admin#reports#activity",
  "id": {
    "time": "2026-06-29T17:29:33.139Z",
    "uniqueQualifier": "1037421216675414524",
    "applicationName": "drive",
    "customerId": "C00000000"
  },
  "etag": "\"3Uy7N2fsLO-UJLJooEizV70OrVTg5GdiS5meIFM6OVQ/0abf1zPyg29hiwPTrvr589WnTIc\"",
  "actor": {
    "email": "user@example.com",
    "profileId": "100000000000000000000",
    "applicationInfo": {
      "oauthClientId": "000000000000-00000000000000000000000000000000.apps.googleusercontent.com",
      "applicationName": "dw-capture-client",
      "impersonation": false
    }
  },
  "ipAddress": "203.0.113.10",
  "networkInfo": {
    "ipAsn": [
      64512
    ],
    "regionCode": "US",
    "subdivisionCode": "US-XX"
  },
  "events": [
    {
      "type": "access",
      "name": "trash",
      "parameters": [
        {
          "name": "primary_event",
          "boolValue": true
        },
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "user@example.com"
        },
        {
          "name": "doc_id",
          "value": "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
        },
        {
          "name": "doc_type",
          "value": "document"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "DW Copied Doc"
        },
        {
          "name": "visibility",
          "value": "private"
        },
        {
          "name": "originating_app_id",
          "value": "000000000000"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ],
      "resourceIds": [
        "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
      ]
    }
  ],
  "resourceDetails": [
    {
      "id": "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0",
      "title": "DW Copied Doc",
      "type": "DRIVE_ITEM",
      "relation": "DRIVE_PRIMARY",
      "ownerDetails": {
        "ownerType": "USER",
        "ownerIdentity": [
          {
            "userIdentity": {
              "id": "2pta16n23k0tb9",
              "userEmail": "user@example.com"
            }
          }
        ]
      }
    }
  ]
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

YARA-L #

Google Workspace Multiple Files Deleted From Google Drive source high: Identifies when a user deletes multiple files from Google Drive, which may indicate data destruction.T1485↳ also matches delete: Delete

Panther #

GSuite Drive Many Documents Deleted source medium: Detects when a user moves more than 10 distinct documents to the trash in Google Drive within 60 minutes. This may indicate accidental or malicious bulk deletion of files.T1485
GSuite Many Docs Deleted Query source: Query to search for a user deleting many documents.
GSuite Drive Many Documents Deleted source medium linked query: GSuite Many Docs Deleted Query: Scheduled rule for the GSuite Drive Many Documents Deleted query. Looks for users who have deleted more than 10 (tunable) documents the past day.

References #

Drive Activity Events: trash

view: View

ApplicationName: drive

Description

A Drive file was viewed.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`target.resource.attribute.labels["visibility"]`	2 detection rules	YARA-L
`target.resource.name`	2 detection rules	YARA-L
`event.action`	1 detection rule	Elastic
`file.extension`	1 detection rule	Elastic
`google_workspace.drive.visibility`	1 detection rule	Elastic
`source.user.email`	1 detection rule	Elastic

Example Audit Activity #

{
  "kind": "admin#reports#activity",
  "id": {
    "time": "2022-08-02T07:29:23.535Z",
    "uniqueQualifier": "-7899252993688670203",
    "applicationName": "drive",
    "customerId": "C00mpaiwz"
  },
  "etag": "\"_ZVRqe-BUDYcYeOIPo-gm6Eh1QaGne4ACjHHI6qsr6A/HK-NfhUq0034cxeMT6zYusGZNtE\"",
  "actor": {
    "email": "admin@cloud-response.com",
    "profileId": "111440584475724055600"
  },
  "ipAddress": "86.48.11.48",
  "events": [
    {
      "type": "access",
      "name": "view",
      "parameters": [
        {
          "name": "primary_event",
          "boolValue": true
        },
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "doc_id",
          "value": "1w2XhnVW0SK3fZLFq4_yFUyuIVN4z3hWF"
        },
        {
          "name": "doc_type",
          "value": "folder"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "Customers"
        },
        {
          "name": "visibility",
          "value": "private"
        },
        {
          "name": "originating_app_id",
          "value": "691301496089"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "admin@cloud-response.com"
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ]
    }
  ]
}

Common Indicators #

Field	Kind	Value	Rules	Vendors
`target.resource.attribute.labels["visibility"] (Chronicle)`	eq	`people_with_link`	2 rules	chronicle
`target.resource.attribute.labels["visibility"] (Chronicle)`	eq	`public_on_the_web`	2 rules	chronicle
`file.extension` (elastic rule field)	eq	`p7b`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Google Workspace Drive Encryption Key(s) Accessed from Anonymous User source high: Detects when an anonymous user views, copies, or downloads a private key or credential file from Google Drive via an anyone-with-the-link share. Adversaries who obtain or create open Drive links can harvest encryption keys and secrets stored in user drives, then use those materials to decrypt data, authenticate to services, or expand access beyond the initial compromise.T1530, T1552, T1552.004↳ also matches copy: Copy, download: Download

YARA-L #

Google Workspace Encryption Key File Accessed By An Anonymous User source medium: Identifies when an encryption key file is accessed by an anonymous user in Google Drive. An adversary may attempt to access encryption keys before moving laterally and compromising sensitive data.T1552↳ also matches copy: Copy, download: Download
Google Workspace Malicious File Downloaded source medium: Identifies when a user downloads a potentially malicious file from Google Drive.T1204↳ also matches copy: Copy, download: Download

References #

create: Create

ApplicationName: drive

Description

A new file or folder was created in Drive.

Example Audit Activity #

{
  "kind": "admin#reports#activity",
  "id": {
    "time": "2026-06-29T17:28:13.755Z",
    "uniqueQualifier": "1770824602804639466",
    "applicationName": "drive",
    "customerId": "C00000000"
  },
  "etag": "\"3Uy7N2fsLO-UJLJooEizV70OrVTg5GdiS5meIFM6OVQ/0JL-fYgF_Q8ewPUueAjXdzpdE6g\"",
  "actor": {
    "email": "user@example.com",
    "profileId": "100000000000000000000",
    "applicationInfo": {
      "oauthClientId": "000000000000-00000000000000000000000000000000.apps.googleusercontent.com",
      "applicationName": "dw-capture-client",
      "impersonation": false
    }
  },
  "ipAddress": "203.0.113.10",
  "networkInfo": {
    "ipAsn": [
      64512
    ],
    "regionCode": "US",
    "subdivisionCode": "US-XX"
  },
  "events": [
    {
      "type": "access",
      "name": "edit",
      "parameters": [
        {
          "name": "primary_event",
          "boolValue": false
        },
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "user@example.com"
        },
        {
          "name": "doc_id",
          "value": "1Cs9t1SIsLKGI42Q1F5k4iolvQ8TAu1eN"
        },
        {
          "name": "doc_type",
          "value": "txt"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "dwprobe.txt"
        },
        {
          "name": "visibility",
          "value": "private"
        },
        {
          "name": "originating_app_id",
          "value": "000000000000"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ],
      "resourceIds": [
        "1Cs9t1SIsLKGI42Q1F5k4iolvQ8TAu1eN"
      ]
    },
    {
      "type": "access",
      "name": "create",
      "parameters": [
        {
          "name": "encryption_enforcement_option",
          "value": "disabled"
        },
        {
          "name": "primary_event",
          "boolValue": true
        },
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "user@example.com"
        },
        {
          "name": "doc_id",
          "value": "1Cs9t1SIsLKGI42Q1F5k4iolvQ8TAu1eN"
        },
        {
          "name": "doc_type",
          "value": "txt"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "dwprobe.txt"
        },
        {
          "name": "visibility",
          "value": "private"
        },
        {
          "name": "originating_app_id",
          "value": "000000000000"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ],
      "resourceIds": [
        "1Cs9t1SIsLKGI42Q1F5k4iolvQ8TAu1eN"
      ]
    },
    {
      "type": "acl_change",
      "name": "change_user_access",
      "parameters": [
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "visibility_change",
          "value": "none"
        },
        {
          "name": "target_user",
          "value": "user@example.com"
        },
        {
          "name": "old_value",
          "multiValue": [
            "none"
          ]
        },
        {
          "name": "new_value",
          "multiValue": [
            "owner"
          ]
        },
        {
          "name": "old_visibility",
          "value": "unknown"
        },
        {
          "name": "primary_event",
          "boolValue": false
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "user@example.com"
        },
        {
          "name": "doc_id",
          "value": "1Cs9t1SIsLKGI42Q1F5k4iolvQ8TAu1eN"
        },
        {
          "name": "doc_type",
          "value": "txt"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "dwprobe.txt"
        },
        {
          "name": "visibility",
          "value": "private"
        },
        {
          "name": "originating_app_id",
          "value": "000000000000"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ],
      "resourceIds": [
        "1Cs9t1SIsLKGI42Q1F5k4iolvQ8TAu1eN"
      ]
    },
    {
      "type": "acl_change",
      "name": "change_acl_editors",
      "parameters": [
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "visibility_change",
          "value": "none"
        },
        {
          "name": "old_value",
          "multiValue": [
            "owner"
          ]
        },
        {
          "name": "new_value",
          "multiValue": [
            "owner",
            "writers"
          ]
        },
        {
          "name": "old_visibility",
          "value": "unknown"
        },
        {
          "name": "primary_event",
          "boolValue": false
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "user@example.com"
        },
        {
          "name": "doc_id",
          "value": "1Cs9t1SIsLKGI42Q1F5k4iolvQ8TAu1eN"
        },
        {
          "name": "doc_type",
          "value": "txt"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "dwprobe.txt"
        },
        {
          "name": "visibility",
          "value": "private"
        },
        {
          "name": "originating_app_id",
          "value": "000000000000"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ],
      "resourceIds": [
        "1Cs9t1SIsLKGI42Q1F5k4iolvQ8TAu1eN"
      ]
    },
    {
      "type": "access",
      "name": "add_to_folder",
      "parameters": [
        {
          "name": "destination_folder_title",
          "multiValue": [
            "Root"
          ]
        },
        {
          "name": "destination_folder_id",
          "multiValue": [
            "0ADCh7zD0vl6sUk9PVA"
          ]
        },
        {
          "name": "primary_event",
          "boolValue": false
        },
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "user@example.com"
        },
        {
          "name": "doc_id",
          "value": "1Cs9t1SIsLKGI42Q1F5k4iolvQ8TAu1eN"
        },
        {
          "name": "doc_type",
          "value": "txt"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "dwprobe.txt"
        },
        {
          "name": "visibility",
          "value": "private"
        },
        {
          "name": "originating_app_id",
          "value": "000000000000"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ],
      "resourceIds": [
        "1Cs9t1SIsLKGI42Q1F5k4iolvQ8TAu1eN"
      ]
    }
  ],
  "resourceDetails": [
    {
      "id": "1Cs9t1SIsLKGI42Q1F5k4iolvQ8TAu1eN",
      "title": "dwprobe.txt",
      "type": "DRIVE_ITEM",
      "relation": "DRIVE_PRIMARY",
      "ownerDetails": {
        "ownerType": "USER",
        "ownerIdentity": [
          {
            "userIdentity": {
              "id": "2pta16n23k0tb9",
              "userEmail": "user@example.com"
            }
          }
        ]
      }
    }
  ]
}

References #

Drive Activity Events

edit: Edit

ApplicationName: drive

Description

A Drive file was edited.

Example Audit Activity #

{
  "kind": "admin#reports#activity",
  "id": {
    "time": "2026-06-29T17:29:07.303Z",
    "uniqueQualifier": "7024766847096578670",
    "applicationName": "drive",
    "customerId": "C00000000"
  },
  "etag": "\"3Uy7N2fsLO-UJLJooEizV70OrVTg5GdiS5meIFM6OVQ/HBs9kO63aJgbwfyIazdUW_6BvdI\"",
  "actor": {
    "email": "user@example.com",
    "profileId": "100000000000000000000",
    "applicationInfo": {
      "oauthClientId": "000000000000-00000000000000000000000000000000.apps.googleusercontent.com",
      "applicationName": "dw-capture-client",
      "impersonation": false
    }
  },
  "ipAddress": "203.0.113.10",
  "networkInfo": {
    "ipAsn": [
      64512
    ],
    "regionCode": "US",
    "subdivisionCode": "US-XX"
  },
  "events": [
    {
      "type": "access",
      "name": "edit",
      "parameters": [
        {
          "name": "primary_event",
          "boolValue": true
        },
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "user@example.com"
        },
        {
          "name": "doc_id",
          "value": "1fcANDjoGwvjlghQIyc_Y-s92B_-hlmihf6rsqrYZfp4"
        },
        {
          "name": "doc_type",
          "value": "document"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "DW Source Doc"
        },
        {
          "name": "visibility",
          "value": "private"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ],
      "resourceIds": [
        "1fcANDjoGwvjlghQIyc_Y-s92B_-hlmihf6rsqrYZfp4"
      ]
    }
  ],
  "resourceDetails": [
    {
      "id": "1fcANDjoGwvjlghQIyc_Y-s92B_-hlmihf6rsqrYZfp4",
      "title": "DW Source Doc",
      "type": "DRIVE_ITEM",
      "relation": "DRIVE_PRIMARY",
      "ownerDetails": {
        "ownerType": "USER",
        "ownerIdentity": [
          {
            "userIdentity": {
              "id": "2pta16n23k0tb9",
              "userEmail": "user@example.com"
            }
          }
        ]
      }
    }
  ]
}

References #

Drive Activity Events

rename: Rename

ApplicationName: drive

Description

A Drive file or folder was renamed.

Example Audit Activity #

{
  "kind": "admin#reports#activity",
  "id": {
    "time": "2022-07-27T09:30:30.646Z",
    "uniqueQualifier": "1383417497530638607",
    "applicationName": "drive",
    "customerId": "C00mpaiwz"
  },
  "etag": "\"_ZVRqe-BUDYcYeOIPo-gm6Eh1QaGne4ACjHHI6qsr6A/mAf9uMUdsoNhDrvLEkWWvmeM2PE\"",
  "actor": {
    "email": "workspace@cloud-response.com",
    "profileId": "102509620547980436027"
  },
  "ipAddress": "80.114.222.200",
  "events": [
    {
      "type": "access",
      "name": "edit",
      "parameters": [
        {
          "name": "primary_event",
          "boolValue": false
        },
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "doc_id",
          "value": "1jrs7AguRkIhxhC3_-_Kgrd9axXugK7k7uySILb5YG3E"
        },
        {
          "name": "doc_type",
          "value": "document"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "Plan for world domination"
        },
        {
          "name": "visibility",
          "value": "private"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "workspace@cloud-response.com"
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ]
    },
    {
      "type": "access",
      "name": "rename",
      "parameters": [
        {
          "name": "primary_event",
          "boolValue": true
        },
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "old_value",
          "multiValue": [
            "Naamloos document"
          ]
        },
        {
          "name": "new_value",
          "multiValue": [
            "Plan for world domination"
          ]
        },
        {
          "name": "doc_id",
          "value": "1jrs7AguRkIhxhC3_-_Kgrd9axXugK7k7uySILb5YG3E"
        },
        {
          "name": "doc_type",
          "value": "document"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "Plan for world domination"
        },
        {
          "name": "visibility",
          "value": "private"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "workspace@cloud-response.com"
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ]
    }
  ]
}

References #

move: Move

ApplicationName: drive

Description

A Drive file or folder was moved to a different location.

References #

Drive Activity Events

upload: Upload

ApplicationName: drive

Description

A file was uploaded to Drive.

References #

Drive Activity Events

print: Print

ApplicationName: drive

Description

A Drive file was printed.

References #

Drive Activity Events

request_access: Request Access

ApplicationName: drive

Description

A user requested access to a Drive file they do not have permission to view.

References #

Drive Activity Events

deny_access_request: Deny Access Request

ApplicationName: drive

Description

An access request to a Drive file was denied.

References #

Drive Activity Events

add_to_folder: Add to Folder

ApplicationName: drive

Description

A Drive file was added to a folder.

Example Audit Activity #

{
  "kind": "admin#reports#activity",
  "id": {
    "time": "2026-06-29T17:29:10.609Z",
    "uniqueQualifier": "-8471868874236111509",
    "applicationName": "drive",
    "customerId": "C00000000"
  },
  "etag": "\"3Uy7N2fsLO-UJLJooEizV70OrVTg5GdiS5meIFM6OVQ/NKGoesMHokFIKZxc8jFRFVkdaQs\"",
  "actor": {
    "email": "user@example.com",
    "profileId": "100000000000000000000",
    "applicationInfo": {
      "oauthClientId": "000000000000-00000000000000000000000000000000.apps.googleusercontent.com",
      "applicationName": "dw-capture-client",
      "impersonation": false
    }
  },
  "ipAddress": "203.0.113.10",
  "networkInfo": {
    "ipAsn": [
      64512
    ],
    "regionCode": "US",
    "subdivisionCode": "US-XX"
  },
  "events": [
    {
      "type": "access",
      "name": "create",
      "parameters": [
        {
          "name": "encryption_enforcement_option",
          "value": "disabled"
        },
        {
          "name": "primary_event",
          "boolValue": true
        },
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "user@example.com"
        },
        {
          "name": "doc_id",
          "value": "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
        },
        {
          "name": "doc_type",
          "value": "document"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "DW Copied Doc"
        },
        {
          "name": "visibility",
          "value": "private"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ],
      "resourceIds": [
        "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
      ]
    },
    {
      "type": "acl_change",
      "name": "change_user_access",
      "parameters": [
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "visibility_change",
          "value": "none"
        },
        {
          "name": "target_user",
          "value": "user@example.com"
        },
        {
          "name": "old_value",
          "multiValue": [
            "none"
          ]
        },
        {
          "name": "new_value",
          "multiValue": [
            "owner"
          ]
        },
        {
          "name": "old_visibility",
          "value": "unknown"
        },
        {
          "name": "primary_event",
          "boolValue": false
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "user@example.com"
        },
        {
          "name": "doc_id",
          "value": "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
        },
        {
          "name": "doc_type",
          "value": "document"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "DW Copied Doc"
        },
        {
          "name": "visibility",
          "value": "private"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ],
      "resourceIds": [
        "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
      ]
    },
    {
      "type": "acl_change",
      "name": "change_acl_editors",
      "parameters": [
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "visibility_change",
          "value": "none"
        },
        {
          "name": "old_value",
          "multiValue": [
            "owner"
          ]
        },
        {
          "name": "new_value",
          "multiValue": [
            "owner",
            "writers"
          ]
        },
        {
          "name": "old_visibility",
          "value": "unknown"
        },
        {
          "name": "primary_event",
          "boolValue": false
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "user@example.com"
        },
        {
          "name": "doc_id",
          "value": "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
        },
        {
          "name": "doc_type",
          "value": "document"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "DW Copied Doc"
        },
        {
          "name": "visibility",
          "value": "private"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ],
      "resourceIds": [
        "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
      ]
    },
    {
      "type": "access",
      "name": "add_to_folder",
      "parameters": [
        {
          "name": "destination_folder_title",
          "multiValue": [
            "Root"
          ]
        },
        {
          "name": "destination_folder_id",
          "multiValue": [
            "0ADCh7zD0vl6sUk9PVA"
          ]
        },
        {
          "name": "primary_event",
          "boolValue": false
        },
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "user@example.com"
        },
        {
          "name": "doc_id",
          "value": "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
        },
        {
          "name": "doc_type",
          "value": "document"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "DW Copied Doc"
        },
        {
          "name": "visibility",
          "value": "private"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ],
      "resourceIds": [
        "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
      ]
    },
    {
      "type": "access",
      "name": "copy",
      "parameters": [
        {
          "name": "copy_type",
          "value": "internal"
        },
        {
          "name": "old_value",
          "multiValue": [
            "DW Source Doc"
          ]
        },
        {
          "name": "new_value",
          "multiValue": [
            "DW Copied Doc"
          ]
        },
        {
          "name": "primary_event",
          "boolValue": true
        },
        {
          "name": "billable",
          "boolValue": true
        },
        {
          "name": "owner_is_shared_drive",
          "boolValue": false
        },
        {
          "name": "owner",
          "value": "user@example.com"
        },
        {
          "name": "doc_id",
          "value": "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
        },
        {
          "name": "doc_type",
          "value": "document"
        },
        {
          "name": "is_encrypted",
          "boolValue": false
        },
        {
          "name": "doc_title",
          "value": "DW Copied Doc"
        },
        {
          "name": "visibility",
          "value": "private"
        },
        {
          "name": "actor_is_collaborator_account",
          "boolValue": false
        },
        {
          "name": "owner_is_team_drive",
          "boolValue": false
        }
      ],
      "resourceIds": [
        "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0"
      ]
    }
  ],
  "resourceDetails": [
    {
      "id": "1guTF-0EXmaPyM_L6l9tJ6AXFdrdsug4C0oEjOHp5fy0",
      "title": "DW Copied Doc",
      "type": "DRIVE_ITEM",
      "relation": "DRIVE_PRIMARY",
      "ownerDetails": {
        "ownerType": "USER",
        "ownerIdentity": [
          {
            "userIdentity": {
              "id": "2pta16n23k0tb9",
              "userEmail": "user@example.com"
            }
          }
        ]
      }
    }
  ]
}

References #

Drive Activity Events

change_owner: Document Changed Owners

ApplicationName: drive

Description

A Drive document changed owners.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`name`	1 detection rule	Panther
`parameters.visibility`	1 detection rule	Panther

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

GSuite Document External Ownership Transfer source low: A GSuite document's ownership was transferred to an external party.T1213

References #

Drive Activity Events: change_owner

Drive

any: Drive (any event)

Description

Detection Fields #

Common Indicators #

Detection Rules #

Splunk #

Panther #

References #

change_acl_editors: Change ACL Editors

Description

Detection Fields #

Example Audit Activity #

Common Indicators #

Detection Rules #

YARA-L #

References #

change_document_access_scope: Change Document Access Scope

Description

Detection Fields #

Example Audit Activity #

Common Indicators #

Detection Rules #

YARA-L #

References #

change_document_visibility: Change Document Visibility

Description

Detection Fields #

Example Audit Activity #

Common Indicators #

Detection Rules #

YARA-L #

Panther #

References #

change_user_access: Change User Access

Description

Detection Fields #

Example Audit Activity #

Common Indicators #

Detection Rules #

Splunk #

Kusto #

YARA-L #

Panther #

References #

copy: Copy

Description

Detection Fields #

Example Audit Activity #

Common Indicators #

Detection Rules #

Elastic #

YARA-L #

References #

delete: Delete

Description

Example Audit Activity #

Detection Rules #

YARA-L #

References #

download: Download

Description

Detection Fields #

Example Audit Activity #

Common Indicators #

Detection Rules #

Elastic #

YARA-L #

Panther #

References #

email_as_attachment: Email as Attachment

Description

Detection Fields #

Common Indicators #

Detection Rules #

YARA-L #

References #

source_copy: Source Copy

Description

Example Audit Activity #