GCP Google Workspace Admin: API client access authorized at domain level

title: "GCP Google Workspace Admin: API client access authorized at domain level"
id: a3d4949e-3bac-4446-bb4f-723a7db9086b
status: test
description: This rule flags instances where an API access service account is authorized to access domain authority via the Google Workspace Admin API. Granting API client access can enable attackers or administrators to perform privileged actions through API calls, supporting privilege escalation or persistence. The detection relies on Google Workspace audit events that include the admin.googleapis.com service and the AUTHORIZE_API_CLIENT_ACCESS action.
references:
  - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3
  - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings#AUTHORIZE_API_CLIENT_ACCESS
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/gworkspace/admin/gcp_gworkspace_granted_domain_api_access.yml
author: Austin Songer, Huntrule Team
date: 2021-08-23
modified: 2023-10-11
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1098
logsource:
  product: gcp
  service: google_workspace.admin
detection:
  selection:
    eventService: admin.googleapis.com
    eventName: AUTHORIZE_API_CLIENT_ACCESS
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 04e2a23a-9b29-4a5c-be3a-3542e3f982ba
    type: derived