Google Workspace: Multiple Files Sent as Email Attachments from Google Drive to Free Email Domains

Google SecOps@GoogleSecOps

•updated Jan 30, 2025•2•0•65

This rule identifies potential data exfiltration attempts where a user sends multiple files (more than 10) from Google Drive as email attachments to free email domains (e.g., gmail.com, aol.com, hotmail.com, outlook.com, icloud.com) within a one-hour window. This behavior can indicate an adversary attempting to move sensitive data out of the organization's controlled environment.