LoFP LoFP / users exporting or reviewing many drive files through chatgpt during approved research, ediscovery, or migration work.

Techniques

Sample rules

OpenAI ChatGPT Enterprise Google Drive Download Burst

Description

Detects a ChatGPT Enterprise user downloading five or more distinct Google Drive files through the Drive connector within a one-hour window. Adversaries who abuse a linked Drive connector after session compromise often stage bulk file retrieval before sharing, forwarding, or other exfiltration.

Detection logic

from logs-openai_chatgpt_enterprise.app_log-*
| where
    data_stream.dataset == "openai_chatgpt_enterprise.app_log" and
    openai_chatgpt_enterprise.app_log.app_name == "Google Drive" and
    openai_chatgpt_enterprise.app_log.log_type == "request" and
    openai_chatgpt_enterprise.app_log.input is not null and
    user.email is not null
| eval
    Esql.download_raw_file = to_lower(field_extract(openai_chatgpt_enterprise.app_log.input, "download_raw_file")),
    Esql.download_url = field_extract(openai_chatgpt_enterprise.app_log.input, "url"),
    Esql.time_bucket = date_trunc(1 hour, @timestamp)
| where Esql.download_raw_file == "true"
| stats
    Esql.download_count = count_distinct(Esql.download_url),
    Esql.download_url_values = values(Esql.download_url),
    Esql.timestamp_first_seen = min(@timestamp),
    Esql.timestamp_last_seen = max(@timestamp)
  by user.email, Esql.time_bucket
| where Esql.download_count >= 5
| keep
    user.email,
    Esql.time_bucket,
    Esql.download_count,
    Esql.download_url_values,
    Esql.timestamp_first_seen,
    Esql.timestamp_last_seen