2_ds_google_google_drive.md

Use-Case	Event Types/Parsers	MITRE TTP	Content
Compromised Credentials	app-activity ↳cef-google-file-activity ↳u-googledrive-file-activity file-delete ↳cef-google-file-activity ↳u-googledrive-file-activity file-permission-change ↳cef-google-file-activity file-read ↳cef-google-file-activity ↳u-googledrive-file-activity file-write ↳u-googledrive-file-permission-change ↳cef-google-file-activity	T1003.001 - T1003.001 T1003.003 - T1003.003 T1020 - Automated Exfiltration T1071 - Application Layer Protocol T1078 - Valid Accounts T1083 - File and Directory Discovery T1133 - External Remote Services	48 Rules 25 Models
Data Access	app-activity ↳cef-google-file-activity ↳u-googledrive-file-activity file-delete ↳cef-google-file-activity ↳u-googledrive-file-activity file-permission-change ↳cef-google-file-activity file-read ↳cef-google-file-activity ↳u-googledrive-file-activity file-write ↳u-googledrive-file-permission-change ↳cef-google-file-activity	T1078 - Valid Accounts T1083 - File and Directory Discovery	37 Rules 21 Models
Data Exfiltration	app-activity ↳cef-google-file-activity ↳u-googledrive-file-activity file-delete ↳cef-google-file-activity ↳u-googledrive-file-activity file-permission-change ↳cef-google-file-activity file-read ↳cef-google-file-activity ↳u-googledrive-file-activity file-write ↳u-googledrive-file-permission-change ↳cef-google-file-activity	T1204 - User Execution	2 Rules 1 Models
Data Leak	app-activity ↳cef-google-file-activity ↳u-googledrive-file-activity file-delete ↳cef-google-file-activity ↳u-googledrive-file-activity file-permission-change ↳cef-google-file-activity file-read ↳cef-google-file-activity ↳u-googledrive-file-activity file-write ↳u-googledrive-file-permission-change ↳cef-google-file-activity	T1048 - Exfiltration Over Alternative Protocol T1114.001 - T1114.001 T1114.003 - Email Collection: Email Forwarding Rule	4 Rules
Destruction of Data	app-activity ↳cef-google-file-activity ↳u-googledrive-file-activity file-delete ↳cef-google-file-activity ↳u-googledrive-file-activity file-permission-change ↳cef-google-file-activity file-read ↳cef-google-file-activity ↳u-googledrive-file-activity file-write ↳u-googledrive-file-permission-change ↳cef-google-file-activity	T1070.004 - Indicator Removal on Host: File Deletion	1 Rules
Evasion	app-activity ↳cef-google-file-activity ↳u-googledrive-file-activity file-delete ↳cef-google-file-activity ↳u-googledrive-file-activity file-permission-change ↳cef-google-file-activity file-read ↳cef-google-file-activity ↳u-googledrive-file-activity file-write ↳u-googledrive-file-permission-change ↳cef-google-file-activity	T1090.003 - Proxy: Multi-hop Proxy	1 Rules
Malware	app-activity ↳cef-google-file-activity ↳u-googledrive-file-activity file-delete ↳cef-google-file-activity ↳u-googledrive-file-activity file-permission-change ↳cef-google-file-activity file-read ↳cef-google-file-activity ↳u-googledrive-file-activity file-write ↳u-googledrive-file-permission-change ↳cef-google-file-activity	T1003.002 - T1003.002 T1027 - Obfuscated Files or Information T1055.012 - T1055.012 T1078 - Valid Accounts T1204 - User Execution T1218.011 - Signed Binary Proxy Execution: Rundll32	7 Rules 3 Models
Privilege Abuse	app-activity ↳cef-google-file-activity ↳u-googledrive-file-activity file-delete ↳cef-google-file-activity ↳u-googledrive-file-activity file-permission-change ↳cef-google-file-activity file-read ↳cef-google-file-activity ↳u-googledrive-file-activity file-write ↳u-googledrive-file-permission-change ↳cef-google-file-activity	T1078 - Valid Accounts T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	7 Rules 2 Models
Privilege Escalation	app-activity ↳cef-google-file-activity ↳u-googledrive-file-activity file-delete ↳cef-google-file-activity ↳u-googledrive-file-activity file-permission-change ↳cef-google-file-activity file-read ↳cef-google-file-activity ↳u-googledrive-file-activity file-write ↳u-googledrive-file-permission-change ↳cef-google-file-activity	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Privileged Activity	app-activity ↳cef-google-file-activity ↳u-googledrive-file-activity file-delete ↳cef-google-file-activity ↳u-googledrive-file-activity file-permission-change ↳cef-google-file-activity file-read ↳cef-google-file-activity ↳u-googledrive-file-activity file-write ↳u-googledrive-file-permission-change ↳cef-google-file-activity	T1078 - Valid Accounts T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules
Ransomware	app-activity ↳cef-google-file-activity ↳u-googledrive-file-activity file-delete ↳cef-google-file-activity ↳u-googledrive-file-activity file-permission-change ↳cef-google-file-activity file-read ↳cef-google-file-activity ↳u-googledrive-file-activity file-write ↳u-googledrive-file-permission-change ↳cef-google-file-activity	T1078 - Valid Accounts T1486 - Data Encrypted for Impact	2 Rules