Sunturai
Threat report

www.elastic.co/security-labs/google-workspace-attack-surface-part-two

https://www.elastic.co/security-labs/google-workspace-attack-surface-part-two
Published on
www.elastic.co

ATT&CK techniques those detections carry

  • T1098Account Manipulation
  • T1484Domain or Tenant Policy Modification
  • T1078Valid Accounts
  • T1078.004Cloud Accounts
  • T1562Impair Defenses
  • T1098.003Additional Cloud Roles
  • T1556Modify Authentication Process
  • T1562.001Disable or Modify Tools
  • +21 more
Open the original

24 published detections cite this

Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.

Detections citing this reference
DetectionSeverity
Google Workspace Bitlocker Setting DisabledMedium
Google Workspace Object Copied from External Drive with App ConsentHigh
Google Workspace User Organizational Unit ChangedLow
Google Workspace Role ModifiedHigh
Google Workspace Password Policy ModifiedMedium
Google Workspace Custom Admin Role CreatedMedium
Google Workspace API Access Granted via Domain-Wide DelegationHigh
Google Workspace Admin Role Assigned to a User or GroupHigh
Google Workspace 2SV Policy Disabled By UserHigh
Application Added to Google Workspace DomainHigh
Google Workspace Suspended User Account RenewedHigh
Google Workspace Impossible Travel LoginHigh
External User Added to Google Workspace GroupMedium
Google Workspace MFA Enforcement Disabled For OrganizationHigh
Google Workspace Admin Role DeletionMedium
Google Workspace Restrictions for Marketplace Modified to Allow Any AppMedium
First Time Seen Google Workspace OAuth Login from Third-Party ApplicationMedium
Domain Added to Google Workspace Trusted DomainsHigh
Application Removed from Blocklist in Google WorkspaceMedium
Google Workspace Drive Encryption Key(s) Accessed from Anonymous UserHigh
Google Workspace Gmail Routing or Forwarding Rule Created or ModifiedHigh
Google Workspace Drive Data Transfer or Takeout Export InitiatedMedium
Forwarded Google Workspace Security AlertHigh
MFA Disabled for Google Workspace OrganizationHigh

Showing 24 of 24

Filter in the catalogue

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice