Elastic high stable kql
Domain Added to Google Workspace Trusted Domains
Detects when an administrator adds a domain to the Google Workspace allowlisted (trusted) domains list. Adversaries with administrative access may onboard a domain they control to relax cross-organization sharing restrictions, enabling data collection and exfiltration through Drive, Chat, and other services that honor the tenant trust boundary.
Detection Logic
data_stream.dataset:google_workspace.admin and event.action:ADD_TRUSTED_DOMAINSFalse Positives
- ⚠ Trusted domains may be added by system administrators. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.
Field Validations
Loading…
Comments (0)
Loading comments...