Google Workspace Malicious File Downloaded
This rule identifies when a user downloads, views, or copies a potentially malicious file from Google Drive. The detection is triggered if the file has a public visibility setting ('people_with_link' or 'public_on_the_web') and its name matches a common executable or script file extension (e.g., .dll, .exe, .scr, .jar, .pif, .app, .dmg, .pkg, .elf, .so, .bin, .deb, .rpm, .sh, .hta, .lnk). This aims to detect user interaction with suspicious files that could lead to execution of malicious code.
YARA-L
