LoFP / developers may leverage third-party applications for legitimate purposes in google workspace such as for administrative tasks.

Techniques

• T1078
• T1550

Sample rules

First Time Seen Google Workspace OAuth Login from Third-Party Application

• source: elastic
• technicques:
  • T1078
  • T1550

Description

Detects the first time a user authorizes a third-party Google OAuth application that requests identity or sign-in scopes. Adversaries may abuse compromised credentials or phishing-linked consent flows to register novel OAuth clients, obtain refresh tokens, and authenticate as valid users while evading password-only detections.

Detection logic

data_stream.dataset: "google_workspace.token"
  and event.action: "authorize"
  and google_workspace.token.scope.value: (*openid* or *userinfo.email* or *userinfo.profile* or *Login*)
  and google_workspace.token.client.id: *apps.googleusercontent.com