GSuite Drive Many Documents Deleted

AnalysisType: rule
Filename: gsuite_drive_many_docs_deleted.py
RuleID: "GSuite.Drive.BulkDocumentDeletion"
DisplayName: "GSuite Drive Many Documents Deleted"
Status: Experimental
Enabled: true
Severity: Medium
DedupPeriodMinutes: 60
Threshold: 11
LogTypes:
  - GSuite.ActivityEvent
Description: >
  Detects when a user moves more than 10 distinct documents to the trash in Google Drive
  within 60 minutes. This may indicate accidental or malicious bulk deletion of files.
Reference: https://support.google.com/drive/answer/2375102
Reports:
  MITRE ATT&CK:
    - TA0040:T1485
Tags:
  - GSuite
  - Impact
  - Data Destruction
Runbook: |
  1. Query GSuite.ActivityEvent for all trash events by actor:email in the 2 hours around this alert to identify the full list of parameters:doc_title values deleted and whether they belong to shared drives
  2. Check parameters:visibility on the deleted documents to determine if externally or internally shared files were affected, and assess the business impact of the deletions
  3. Search for other suspicious drive activity by this user in the past 24 hours, including bulk downloads, sharing changes, or access to sensitive documents prior to deletion
Tests:
  - Name: Document Trashed
    ExpectedResult: true
    Log:
      name: trash
      id:
        applicationName: drive
      actor:
        email: user@example.com
      parameters:
        doc_id: "1ABC123def456GHI789jkl"
        doc_title: "Q4 Financial Report"
        doc_type: spreadsheet
        visibility: shared_internally
  - Name: Externally Shared Document Trashed - High Severity
    ExpectedResult: true
    Log:
      name: trash
      id:
        applicationName: drive
      actor:
        email: user@example.com
      parameters:
        doc_id: "1XYZ987uvw654MNO321pqr"
        doc_title: "Partner Contract"
        doc_type: document
        visibility: shared_externally
  - Name: Document Viewed - Not Deletion
    ExpectedResult: false
    Log:
      name: view
      id:
        applicationName: drive
      actor:
        email: user@example.com
      parameters:
        doc_title: "Q4 Financial Report"
        doc_type: spreadsheet
  - Name: Document Downloaded - Not Deletion
    ExpectedResult: false
    Log:
      name: download
      id:
        applicationName: drive
      actor:
        email: user@example.com
      parameters:
        doc_title: "Q4 Financial Report"
        doc_type: spreadsheet
  - Name: Gmail Trash - Not Drive
    ExpectedResult: false
    Log:
      name: trash
      id:
        applicationName: gmail
      actor:
        email: user@example.com


# ------ paired body: gsuite_drive_many_docs_deleted.py ------

def rule(event):
    if event.deep_get("id", "applicationName") != "drive":
        return False
    return event.get("name") == "trash"


def title(event):
    user = event.deep_get("actor", "email", default="<UNKNOWN_USER>")
    return f"Google Workspace: User [{user}] deleted many documents from Google Drive"


def dedup(event):
    return event.deep_get("actor", "email", default="")


def unique(event):
    return event.deep_get("parameters", "doc_id") or None


def severity(event):
    visibility = event.deep_get("parameters", "visibility", default="")
    if visibility == "shared_externally":
        return "HIGH"
    return "DEFAULT"


def alert_context(event):
    return {
        "user": event.deep_get("actor", "email"),
        "doc_title": event.deep_get("parameters", "doc_title"),
        "doc_type": event.deep_get("parameters", "doc_type"),
        "visibility": event.deep_get("parameters", "visibility"),
    }