Massive files deletion in Google Drive

Cortex XDR Analytics Alert Reference by data source

Product

Cortex XDR

Last date published

2026-07-12

Activation Period	14 Days
Training Period	30 Days
Test Period	1 Hour
Deduplication Period	1 Day
Required Data	Requires: Google Workspace Audit Logs
Detection Modules	Identity Threat Module
Detector Tags	Data Detection & Response, Google Workspace
ATT&CK Tactic	Impact (TA0040)
ATT&CK Technique	Data Destruction (T1485)
Severity	Informational

A user deleted a large amount of data in Google Drive. This behavior may indicate that the data is being wiped.

An attacker may delete files from a SaaS service to wipe data from the organization.

Investigate the source account and verify if it was compromised or performed an authorized activity.
Review the files that were deleted to determine if they contain sensitive or critical data.
Monitor the account for any further suspicious actions.

A suspicious user deleted a large amount of data in Google Drive. This behavior may indicate that the data is being wiped.

An attacker may delete files from a SaaS service to wipe data from the organization.

Investigate the source account and verify if it was compromised or performed an authorized activity.
Review the files that were deleted to determine if they contain sensitive or critical data.
Monitor the account for any further suspicious actions.