Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

First Time Seen Google Workspace OAuth Login from Third-Party Application

Detects the first time a user authorizes a third-party Google OAuth application that requests identity or sign-in scopes. Adversaries may abuse compromised credentials or phishing-linked consent flows to register novel OAuth clients, obtain refresh tokens, and authenticate as valid users while evading password-only detections.

ATT&CK coverage

Outside the enterprise matrix

Detection requirements

Log source category: event_index

What the source says

What fires this without an attack behind it

Developers may leverage third-party applications for legitimate purposes in Google Workspace such as for administrative tasks.

References

Tagged by the source as

Data Source: Google WorkspaceDomain: CloudResources: Investigation GuideTactic: Defense EvasionTactic: Initial AccessTactic: Persistence

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.