Google Workspace Granted Domain API Access

Title: Google Workspace Granted Domain API Access
Status: test
Description:Detects when an API access service account is granted domain authority.
References:
  -https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3
  -https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings#AUTHORIZE_API_CLIENT_ACCESS
Author: Austin Songer
Date: 2021-08-23
modified:2023-10-11
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.t1098'

Logsource:

• product: gcp
• service: google_workspace.admin

Detection:
  selection:
    eventService: 'admin.googleapis.com'
    eventName: 'AUTHORIZE_API_CLIENT_ACCESS'
  condition:selection
Falsepositives:
  -Unknown
Level: medium