Sunturai
Back to results
MediumMicrosoft Sentinel analytics

GWorkspace - License Revoke and Assignment to User

This hunting query searches for license revoke and assignment in quick succession to user, potential sign of data exfiltration.…

Description

This hunting query searches for license revoke and assignment in quick succession to user, potential sign of data exfiltration. https://www.mitiga.io/blog/mitiga-security-advisory-lack-of-forensic-visibility-with-the-basic-license-in-google-drive

Detection logic

Detection requirements

Platform
IaaSOffice SuiteSaaS

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source product
googleworkspacereportsapi
Log source service
gworkspaceactivityreports

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice