Elastic high stable kql

Application Added to Google Workspace Domain

Detects when an administrator adds a Google Workspace Marketplace application to the domain. Adversaries with administrative access may register a malicious OAuth application to establish long-lived API access to mail, drive, and other Workspace data, maintaining persistence and enabling collection without relying on a single user password alone.

View Source

Detection Logic

data_stream.dataset:google_workspace.admin and event.action:ADD_APPLICATION

False Positives

  • ⚠ Applications can be added to a Google Workspace domain by system administrators. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.

Field Validations

Loading…

Comments (0)

Loading comments...