Google Workspace Forensics – Insights from Real-World Hunts & IR

No ratings

Presented at BSidesLV 2023 by

Ariel Szarf

Doron Karmi

Google Workspace is now the core IT infrastructure for many organizations, according to Google’s “2021 Year in Review”, 3 billion people use Google Workspace, drawing hackers to directly attack GWS users and resources. Forensics investigators may struggle identifying threats in GWS logs efficiently because of the complexity and the uniqueness of the logs. In this talk, we share our knowledge & expertise on how to hunt and perform IR investigation over Google Workspace logs based on real-world threat hunt focused on data exfiltration from Google Drive. In this presentation, we will show the work of forensic investigator in Google Workspace (formerly G Suite) domain. We believe this knowledge is necessary for those who want to investigate Google Workspace logs.