LoFP / trusted domains may be added by system administrators. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.

Techniques

• T1484
• T1562

Sample rules

Domain Added to Google Workspace Trusted Domains

• source: elastic
• technicques:
  • T1484
  • T1562

Description

Detects when an administrator adds a domain to the Google Workspace allowlisted (trusted) domains list. Adversaries with administrative access may onboard a domain they control to relax cross-organization sharing restrictions, enabling data collection and exfiltration through Drive, Chat, and other services that honor the tenant trust boundary.

Detection logic

data_stream.dataset:google_workspace.admin and event.action:ADD_TRUSTED_DOMAINS