Data Exfiltrated to Google Drive Cloud Storage

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•5

This rule detects attempts to exfiltrate data to Google Drive cloud storage. It specifically looks for HTTP POST requests to 'www.googleapis.com' with the URI containing '/upload/drive/' and a data size greater than 10000 bytes. This pattern is indicative of a file upload operation to Google Drive.