Sunturai
Threat report

www.elastic.co/security-labs/google-workspace-attack-surface-part-one

https://www.elastic.co/security-labs/google-workspace-attack-surface-part-one
Published on
www.elastic.co

ATT&CK techniques those detections carry

  • T1098Account Manipulation
  • T1078Valid Accounts
  • T1078.004Cloud Accounts
  • T1484Domain or Tenant Policy Modification
  • T1562Impair Defenses
  • T1098.003Additional Cloud Roles
  • T1098.005Device Registration
  • T1556Modify Authentication Process
  • +22 more
Open the original

28 published detections cite this

Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.

Detections citing this reference
DetectionSeverity
Google Workspace Bitlocker Setting DisabledMedium
Google Workspace Object Copied from External Drive with App ConsentHigh
Google Workspace User Organizational Unit ChangedLow
Google Workspace Role ModifiedHigh
Google Workspace Password Policy ModifiedMedium
Google Workspace Device Registration Burst for Single UserMedium
Google Workspace User Sign-in from Atypical Device TypeMedium
Google Workspace Device Registration After OAuth from Suspicious ASNHigh
Google Workspace Custom Admin Role CreatedMedium
Google Workspace API Access Granted via Domain-Wide DelegationHigh
Google Workspace Admin Role Assigned to a User or GroupHigh
Google Workspace 2SV Policy Disabled By UserHigh
Application Added to Google Workspace DomainHigh
Google Workspace Suspended User Account RenewedHigh
Google Workspace Impossible Travel LoginHigh
Google Workspace User Login with Unusual ASNLow
External User Added to Google Workspace GroupMedium
Google Workspace MFA Enforcement Disabled For OrganizationHigh
Google Workspace Admin Role DeletionMedium
Google Workspace Restrictions for Marketplace Modified to Allow Any AppMedium
First Time Seen Google Workspace OAuth Login from Third-Party ApplicationMedium
Domain Added to Google Workspace Trusted DomainsHigh
Application Removed from Blocklist in Google WorkspaceMedium
Google Workspace Drive Encryption Key(s) Accessed from Anonymous UserHigh
Google Workspace Gmail Routing or Forwarding Rule Created or ModifiedHigh

Showing 25 of 28

Filter in the catalogue

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice