Analytics BIOC
Informational
✕
External Sharing was turned on for Google Drive
An identity has modified Google Drive sharing settings and allowed external sharing.
- Module:
- Identity Threat Detection (ITDR), SaaS Threat Detection
- Licensed by:
- Identity Threat Detection (ITDR)
- Data source:
- Google Workspace Audit Logs
ATT&CK tactics: Exfiltration (TA0010)
ATT&CK techniques: Transfer Data to Cloud Account (T1537)
Detector tags: Google Workspace
Attacker's goals:
Adversaries may exfiltrate data, such as sensitive documents.
Investigative actions:
Check if the identity intended to perform this action or look for signs that the user account is compromised (e.g. abnormal logins, unusual activity). check the new setting details. Follow further actions done by the account.
- Test period:
- N/A (single event)
- Deduplication:
- 5 Days
3 variations:
- External Sharing was turned on for Google Drive by a non Google Workspace administrative user from an unusual ASN Low (parent: Informational)
- External Sharing was turned on for Google Drive by a non Google Workspace administrative user Low (parent: Informational)
- External Sharing was turned on for Google Drive from an unusual ASN Low (parent: Informational)