ATT&CK T1567 - Exfiltration to Google Drive

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects potential data exfiltration to Google Drive by monitoring HTTP POST requests to 'www.googleapis.com' with a data size greater than 5000 bytes. This pattern is indicative of large data uploads to Google's API services, which could be used for exfiltration.