Google Workspace API Access Granted via Domain-Wide Delegation

Last updated a year ago on 2024-09-23

Created 5 years ago on 2020-11-12

About

Detects when a domain-wide delegation of authority is granted to a service account. Domain-wide delegation can be configured to grant third-party and internal applications to access the data of Google Workspace users. An adversary may configure domain-wide delegation to maintain access to their target’s data.

Tags

Domain: CloudData Source: Google WorkspaceUse Case: Identity and Access AuditTactic: PersistenceLanguage: kuery

Severity

medium

Risk Score

MITRE ATT&CK™

Persistence (TA0003)(external, opens in a new tab or window)

↳ Account Manipulation (T1098)(external, opens in a new tab or window)

False Positive Examples

Domain-wide delegation of authority may be granted to service accounts by system administrators. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: Query (Kibana Query Language)
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: filebeat-*logs-google_workspace*
Related Integrations: google_workspace(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗event.dataset:google_workspace.admin
  and event.provider:admin
  and event.category:iam
  and event.action:AUTHORIZE_API_CLIENT_ACCESS
  and event.outcome:success

Install detection rules in Elastic Security

Detect Google Workspace API Access Granted via Domain-Wide Delegation in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).