Elastic medium stable kql

First Time Seen Google Workspace OAuth Login from Third-Party Application

Detects the first time a user authorizes a third-party Google OAuth application that requests identity or sign-in scopes. Adversaries may abuse compromised credentials or phishing-linked consent flows to register novel OAuth clients, obtain refresh tokens, and authenticate as valid users while evading password-only detections.

View Source

Detection Logic

data_stream.dataset: "google_workspace.token"
  and event.action: "authorize"
  and google_workspace.token.scope.value: (*openid* or *userinfo.email* or *userinfo.profile* or *Login*)
  and google_workspace.token.client.id: *apps.googleusercontent.com

False Positives

⚠ Developers may leverage third-party applications for legitimate purposes in Google Workspace such as for administrative tasks.

Field Validations

Loading…

Comments (0)

Loading comments...