Google Drive File Shared to Free Email Domain
This rule identifies when a user shares a file from Google Drive with an email address belonging to a common free email domain (e.g., gmail.com, aol.com, hotmail.com, outlook.com, icloud.com). This activity is flagged as it may indicate an attempt at data exfiltration, where sensitive information is moved outside the organization's controlled environment to personal or untracked accounts.
YARA-L
