외부 공개 문서에 대한 공유/다운로드/복사 활동 집계하여 과도한 행위자를 탐지합니다.
Overview
| Priority | Medium |
|---|---|
| Type | Batch |
| Schedule | Every month/Every day/At 8 o'clock/At 0 min 0 8 * * * |
| Message | GOOGLE DRIVE - 외부 반출 대량 사용자 : $user 계정이 외부 공유/반출 활동 $event_cnt 건 (공유 $share_cnt / 다운로드 $download_cnt, 외부지정 $ext_cnt / 링크 $link_cnt / 전체공개 $public_cnt), 문서 $doc_cnt 건 탐지 |
| Output field order | user, event_cnt, share_cnt, download_cnt, ext_cnt, link_cnt, public_cnt, doc_cnt, actions |
| MITRE Techniques | T1567.002 |
| MITRE tactics | TA0010 Exfiltration |
| Origin | User proposal |
Query
1table from=$("from") to=$("to") *:GOOGLE_DRIVE
2| search _schema == "google-drive-activity"
3| search in(action, "download", "copy", "change_document_visibility", "change_user_access", "change_acl_editors") and in(visibility, "people_with_link", "public_on_the_web", "public_in_the_domain", "shared_externally")
4| eval user = if(isnull(user) or len(trim(user)) == 0, "(익명/미식별)", user)
5| eval ext_f = if(visibility == "shared_externally", 1, 0),
6 link_f = if(visibility == "people_with_link", 1, 0),
7 pub_f = if(in(visibility, "public_on_the_web", "public_in_the_domain"), 1, 0),
8 share_f = if(in(action, "change_document_visibility", "change_user_access", "change_acl_editors"), 1, 0),
9 dl_f = if(in(action, "download", "copy"), 1, 0)
10| stats count as event_cnt, dc(doc_title) as doc_cnt,
11 sum(share_f) as share_cnt, sum(dl_f) as download_cnt,
12 sum(ext_f) as ext_cnt, sum(link_f) as link_cnt, sum(pub_f) as public_cnt,
13 values(action) as actions
14 by user, user_type
15| search event_cnt >= 20
16| eval actions = if(isnull(actions), "", strjoin(", ", actions))
17| sort -event_cnt