How to investigate a malicious Google Drive share in Google Workspace

A staff member reports a shared document that turned out to be phishing. What to capture first, how to identify the account that actually shared it, what your Drive and Gmail logs can and cannot show for a file your organization does not own, and where the edition line falls between Education Fundamentals, Standard and Plus.

The report that starts it is usually short. I think Dr. Whitaker's account has been hacked. She just shared a weird document with me.

The superintendent's account may not have been touched at all. Her name may have been borrowed by a Google account at another organization, and establishing which is the first real step of the investigation. This guide is that investigation: what to preserve, how to find the account that actually shared the file, what your logs will and will not tell you, and how to work out who else is affected. Removing the notification from inboxes and closing the incident out is the remediation workflow. If the sharing account turns out to be one of yours, switch to what to check after a Google Workspace account is compromised as soon as you know.

Why the notification itself is genuine, and why that proves nothing about the document, is covered in Google Drive share phishing: why the email is real and the document is malicious.

The short answer

Start from the share, not the email. The email is Google's notification. The identity that matters is the Google account that shared the file, and the notification tells you who that is.

Decide internal or external first. An internal sharer means a compromised account in your domain, and that changes the whole response. An external sharer is someone else's account to contain and your recipient list to scope.

Expect your Drive log to be mostly silent. Google logs events on externally owned files on the owner's side, not yours. Your recipient list lives in Gmail.

Every Education edition can find out who received it. Only Education Standard and Plus can read message content and remove messages from inside the Admin console. On Fundamentals that step is done with other tooling.

1. Preserve the facts before anything moves

Get these from the reporting user's copy, and write them down before anyone deletes, reports or "cleans up" anything:

  • The recipient who reported it, and the time they received the notification.
  • The name displayed as the sharer, exactly as shown.
  • The actual account that shared the file: the email address in the notification body and in the file's details in Drive.
  • The document title.
  • The Drive URL, and from it the file ID, which is the long string between /d/ and the next /.
  • Screenshots of the notification and of the document as it appears in Drive.
  • The destination the document points to, if it can be read as text or by hovering over the link. Never obtain it by visiting it.

In this attack pattern, opening the Google-hosted document is usually not the step that compromises anything; the danger is in following the embedded link, approving access, or downloading what it offers. If you are not confident of the difference, work from the screenshots.

Keep three identities separate in your notes from the start: the mail sender (Google's notification service), the Drive sharer (the account that made the share), and the impersonated person (whose name is on the document). They are usually three different parties, and the investigation is about the second one.

2. Identify the account that actually shared it

The notification names the sharer and gives their address. In Drive, the file's details pane under Shared with me shows the owner and who shared it. The Drive API exposes the same fact on the file as sharingUser, which Google defines as "the user who shared the file with the requesting user, if applicable."

If you use GAM, this lists files in the reporting user's Drive that they do not own and whose name matches, with the owner, the account that shared each one, and when:

gam user reporter@example.org print filelist showownedby others query "name contains 'Salary Schedule'" fields id,name,owners.emailaddress,sharinguser.emailaddress,sharedwithmetime

showownedby others matters. GAM's file selection starts from the user's own files by default, and this flips it to files owned by someone else; the query clause is then added to that selection. This command reads and changes nothing.

Now the fork:

The sharer is in your domain. You have a compromised account. Suspend it, then work through the compromised-account checklist. Because that account's files are owned by your organization, its sharing activity is in your Drive log, which is the one case where Drive log events answer most of your questions.

The sharer is external. Record the domain. A free-mail address is a throwaway. A domain that belongs to a school district, a college or a business is a strong sign that an account there has been compromised, and that organization is a party to notify, not a suspect. Either way, the rest of this guide is about finding out how far the share went in your domain.

3. What your Drive log will and will not show

This is the part that surprises people, and Google documents it. From the Drive log events page:

Some events involve users, shared folders, or shared drives outside your organization, such as when a user in your organization shares a file with an external user. Both organizations log an event when it changes the ownership of the item from one organization to another.

Google then lists what your organization logs but the external one does not: your users' files being shared with external users, and external users viewing, editing, downloading, printing or deleting items your organization owns. It closes with one sentence that decides this whole step:

Events logged by the external domain but not by your organization are the reverse of the previous section.

Read the reverse carefully. For a file owned outside your organization, the share to your users, and your users' views, downloads and prints of that file, are logged by the owner's organization. Not by yours.

What your Drive log can still tell you about an externally owned phishing document:

  • Whether one of your users copied it into your domain. Google logs a copy into or out of an organization on both sides, and notes that "the receiving organization logs the copied file's name, not the original file's name."
  • Whether it was moved into a shared drive you own, which is also logged by both organizations.

What it will not tell you is who opened it. Do not spend the first hour looking for a view event that is being written to somebody else's log.

Drive log events are available on Education Fundamentals, Standard and Plus, under Reporting, then Audit and investigation.

4. Find out who received it

Gmail is where your recipient list is. There are three ways to get it, and every edition has at least two.

Email Log Search. Available on every Google Workspace edition, including Education Fundamentals. Search by the notification's sender address, a date range, and the subject. Within 30 days you get full delivery detail. Google documents the limits for anything older: a Google Group address cannot be used, "the recipient email address and the message ID are required", and only post-delivery status is shown. One search returns up to 1,000 messages.

Gmail log events. Under Audit and investigation on Fundamentals, Standard and Plus: sender, recipient, subject, and what happened to the message. On Standard and Plus the same data opens in the security investigation tool, which adds message content and the ability to act on results; that is the edition line, and it is covered below.

GAM, on any edition. This reads every mailbox for notifications from a Google Drive share address with the document's title in the subject, received in the last two days, and prints who got them. Replace the sender address with the exact From address of the notification you preserved in step 1. Google uses more than one; published examples include drive-shares-dm-noreply@google.com and drive-shares-noreply@google.com.

gam all users print messages query "from:drive-shares-dm-noreply@google.com subject:(Salary Schedule) newer_than:2d" headers "Date,Subject,To,Delivered-To"

The query is ordinary Gmail search syntax, which Google documents: from:, subject:( ) to group words, and newer_than:2d. Two cautions. all users means every mailbox in the domain, one at a time, so on a large domain this runs for a while. And a query that names the wrong sender address finds nothing and looks like good news, which is why the address has to come from your preserved copy and not from this page.

The same shape works on the Drive side, and it catches recipients who never opened the email, because a file shared directly with a user appears in their Shared with me whether or not they read the notification:

gam all users print filelist showownedby others query "name contains 'Salary Schedule'" fields id,name,owners.emailaddress,sharinguser.emailaddress,sharedwithmetime

Both commands are read-only. Together they give you the list this whole investigation is for: every account the document reached.

5. Find out whether anyone acted on it

Opening the document is not visible to you when the file is externally owned; that was step 3. What you are looking for instead is the consequences of the click.

  • Credentials entered on a third-party page. No Google log records that. Look for its effects: sign-ins from unfamiliar locations or devices after the notification time, in the user log events, and any suspicious-login alerts in the Alert center, which every Education edition has.
  • An application granted access. If the lure was an OAuth consent screen, the grant is in the OAuth log events under Audit and investigation, and the application appears under the user's security settings as a connected application.
  • A download. Downloads of an externally owned file are logged on the owner's side. Your endpoint tooling is the record, if you have any.
  • Ask. A specific question gets an honest answer: after you opened the document, did you type your password anywhere, or approve anything? Most people know exactly what they did and will tell you if the question is precise and the tone is not accusatory.

Treat the answers differently. Anyone who entered a password, approved an application, or whose account shows a sign-in they cannot explain is a compromised account until proven otherwise: suspend first, then follow the checklist. Anyone who downloaded or ran what the document offered has an endpoint incident first: isolate and examine the device with your endpoint tooling, and judge the Google account on its own evidence, the sign-ins and connected applications above, rather than assuming it went with the device.

6. Report the file

Each recipient can report their copy in Drive: right-click the file under Shared with me, choose Block or report, then Report, pick the type of content, and optionally block the user who shared it. Google is notified, the file moves to that user's Spam, and it is permanently removed after 30 days. Reporting the notification in Gmail (More, then Report phishing) is worth doing as well.

Two things reporting does not do. It acts on one recipient's copy, not on everyone's. And it cannot be used at all when the file is owned by your own organization: Google is explicit that "you can't report files or folders that you or members of your organization own", which is the internal-sharer case, handled as an account incident.

Blocking the sharing account stops that account from sharing with that user again. Against a campaign that runs on compromised or disposable accounts, its value is real but small.

7. Tell the organization whose account was used

If the sharing account belongs to a school, a college or a business, treat it as their compromised account and assume they do not know yet. Find their IT or security contact on their website; security@, abuse@ and postmaster@ are conventional addresses when nothing is published. Send them the account, the document title and file ID, the time with its time zone, and a plain description of what the document did. Send a screenshot, not the live link. You are giving them their first report of an incident, and the tone that gets it acted on is the one you would want.

8. Where the edition line falls

Everything up to this point works on Education Fundamentals. The line is drawn at reading message content and acting on messages from inside the Admin console.

CapabilityEducation FundamentalsEducation StandardEducation Plus
Email Log SearchYesYesYes
Gmail log events (sender, recipient, subject, delivery)YesYesYes
Drive log eventsYesYesYes
Alert centerYesYesYes
Security investigation tool: view message content; delete, mark as spam, mark as phishing or quarantine from search resultsNoYesYes

Google lists the security investigation tool as available with "Education Standard and Education Plus" among other editions, and describes the actions available on a message found in it as Delete message, Mark as spam, Mark as phishing, Send to inbox and Send to quarantine. On Fundamentals the removal step is done with GAM or another tool; on Standard and Plus it is in the console; can a Google Workspace admin delete a phishing email from everyone's inbox? lays the editions out row by row. Either way, removing the notification from inboxes does not revoke the share: the file stays in each recipient's Shared with me, where only the owner, Google, or the recipient can act on it.

What not to do

Do not visit the link to see where it goes. Capture it as text or a screenshot.

Do not forward the notification to colleagues to ask whether it is real, and ask staff not to. Every forward is a fresh delivery of a working lure.

Do not block Google's Drive notification addresses. They carry every legitimate Drive share in your domain.

Do not reset the impersonated person's password as a first move. Find the sharing account first. If it is yours, act on that one.

Do not read "deleted from inboxes" as "share revoked." They are separate systems.

Do not close the case on the reporter alone. One report does not tell you the scope. Search for every recipient, including the ones who never reported it.

Sources

The slowest step here is finding every mailbox the notification reached and clearing it without touching anything else. In ORINEX Workspace Compliance that is Message Removal: pick the scope, enter the Gmail query, review the list of matches, and remove only what you reviewed. The account-side steps that follow are the same ones as in any incident, and the Security & Trust page explains how the tool keeps your credentials and your data on your own machine. What ORINEX Workspace does.