Multiple Files Downloaded from Google Drive
This rule identifies when a single user downloads multiple files from Google Drive within a one-hour window. This behavior can be indicative of data exfiltration attempts, where an attacker or malicious insider is trying to extract sensitive information from the organization's Google Drive storage. The rule specifically looks for 'download' events from the 'Google Workspace' vendor and 'drive' product, and triggers an alert if more than 10 distinct files are downloaded by the same user within the specified timeframe.
YARA-L
