Vendor: Google

Product: Google Drive

Rules	Models	MITRE TTPs	Event Types	Parsers
100	42	19	5	5

Use-Case	Event Types/Parsers	MITRE TTP	Content
Abnormal Authentication & Access	app-activity ↳cef-google-file-activity ↳u-googledrive-file-activity file-delete ↳cef-google-file-activity ↳u-googledrive-file-activity file-permission-change ↳cef-google-file-activity file-read ↳cef-google-file-activity ↳u-googledrive-file-activity file-write ↳u-googledrive-file-permission-change ↳cef-google-file-activity	T1078 - Valid Accounts T1133 - External Remote Services	29 Rules 14 Models
Account Manipulation	app-activity ↳cef-google-file-activity ↳u-googledrive-file-activity file-delete ↳cef-google-file-activity ↳u-googledrive-file-activity file-permission-change ↳cef-google-file-activity file-read ↳cef-google-file-activity ↳u-googledrive-file-activity file-write ↳u-googledrive-file-permission-change ↳cef-google-file-activity	T1098.002 - Account Manipulation: Exchange Email Delegate Permissions	3 Rules 1 Models
Next Page -->>

ATT&CK Matrix for Enterprise

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
External Remote Services Valid Accounts	User Execution	External Remote Services Valid Accounts Account Manipulation Account Manipulation: Exchange Email Delegate Permissions	Valid Accounts Process Injection	Indicator Removal on Host: File Deletion Valid Accounts Indicator Removal on Host Obfuscated Files or Information Process Injection Signed Binary Proxy Execution Signed Binary Proxy Execution: Rundll32	OS Credential Dumping	File and Directory Discovery		Email Collection Email Collection: Email Forwarding Rule	Proxy: Multi-hop Proxy Application Layer Protocol Proxy	Exfiltration Over Alternative Protocol Automated Exfiltration	Data Encrypted for Impact