Token / OAuth

eventName	Description	Sample	Rule
authorize	A user or service authorized an OAuth token for a third-party application.	Y	Y
revoke	An OAuth token granted to a third-party application was revoked.	Y	N
activity	An OAuth-authorized application performed an API activity.	N	N
deny	An OAuth token authorization request was denied.	N	N
request	An OAuth token authorization was requested by a third-party application.	N	N

authorize: Authorize OAuth Token

ApplicationName: token

Description

A user or service authorized an OAuth token for a third-party application.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.

Name	Rules	Vendors
`event.action`	4 detection rules	Elastic
`google_workspace.token.client.id (GWS)`	3 detection rules	Elastic
`id:applicationName`	2 detection rules	Panther
`ipAddress`	2 detection rules	Panther
`name`	2 detection rules	Panther
`source.as.number`	2 detection rules	Elastic
`google_workspace.token.scope.value`	1 detection rule	Elastic
`user.email`	1 detection rule	Elastic

Example Audit Activity #

{
  "kind": "admin#reports#activity",
  "id": {
    "time": "2022-08-15T22:14:10.462Z",
    "uniqueQualifier": "4654910872918186338",
    "applicationName": "token",
    "customerId": "C00mpaiwz"
  },
  "etag": "\"_ZVRqe-BUDYcYeOIPo-gm6Eh1QaGne4ACjHHI6qsr6A/YK5RMkLvGA4EbrRlIo0Mc7MN7BY\"",
  "actor": {
    "email": "admin@cloud-response.com",
    "profileId": "111440584475724055600"
  },
  "ipAddress": "209.94.244.98",
  "events": [
    {
      "name": "authorize",
      "parameters": [
        {
          "name": "client_id",
          "value": "509322733035-mfu29pqjjs2ocvnnb1hifk2ggm9l4jj4.apps.googleusercontent.com"
        },
        {
          "name": "app_name",
          "value": "Data exfil"
        },
        {
          "name": "client_type",
          "value": "WEB"
        },
        {
          "name": "scope_data",
          "multiMessageValue": [
            {
              "parameter": [
                {
                  "name": "scope_name",
                  "value": "https://www.googleapis.com/auth/admin.reports.audit.readonly"
                },
                {
                  "name": "product_bucket",
                  "multiValue": [
                    "GSUITE_ADMIN"
                  ]
                }
              ]
            }
          ]
        },
        {
          "name": "scope",
          "multiValue": [
            "https://www.googleapis.com/auth/admin.reports.audit.readonly"
          ]
        }
      ]
    }
  ]
}

Common Indicators #

Positive field/value combinations most frequently checked by detection rules attached to this catalog entry, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

Field	Kind	Value	Rules	Vendors
`google_workspace.token.client.id (GWS)`	ends_with	`*apps.googleusercontent.com`	2 rules	elastic
`google_workspace.device.account_state (GWS)`	eq	`REGISTERED`	1 rule	elastic
`user.email` (elastic rule field)	is_not_null		1 rule	elastic

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Elastic #

First Time Seen Google Workspace OAuth Login from Third-Party Application source medium: Detects the first time a user authorizes a third-party Google OAuth application that requests identity or sign-in scopes. Adversaries may abuse compromised credentials or phishing-linked consent flows to register novel OAuth clients, obtain refresh tokens, and authenticate as valid users while evading password-only detections.T1078, T1078.004, T1550, T1550.001
Google Workspace Device Registration After OAuth from Suspicious ASN source high: Detects when a Google Workspace account completes OAuth authorization for a specific Google OAuth client from a high-risk autonomous system number (ASN), followed within 30 seconds by a device registration event with account state REGISTERED. This sequence can indicate device enrollment or join flows initiated from attacker-controlled or residential-proxy infrastructure after a user authorizes a sensitive client.T1098, T1098.005, T1566, T1566.002
Google Workspace User Login with Unusual ASN source low: Detects the first time a Google Workspace user successfully signs in from a given source ASN within a 14-day historical window. Most users have a stable set of egress ASNs (home ISP, corporate VPN, mobile carrier). A new ASN for a user is a meaningful anomaly as it surfaces ISP changes and travel, but also catches AiTM phishing-kit relays whose egress ASN was never previously associated with the user.T1078, T1078.004, T1528, T1557

Show 1 more (4 total) on the rules page

Panther #

Google Workspace OAuth Token Requests from New IPs source: Detects users requesting OAuth tokens from IPv4 addresses they haven't used in the past 30 days, with 3+ requests indicating active usage. May indicate GAIA credential theft where attackers use stolen refresh tokens from their infrastructure.
Google Workspace OAuth Token Requests from New IP source medium linked query: Google Workspace OAuth Token Requests from New IPs: Alerts when users request OAuth tokens from IP addresses they haven't used in the past 30 days, with 3+ requests indicating active usage. This may indicate GAIA credential theft where attackers use stolen refresh tokens to request access tokens from their infrastructure.T1078.004, T1550

References #

revoke: Revoke OAuth Token

ApplicationName: token

Description

An OAuth token granted to a third-party application was revoked.

Example Audit Activity #

{
  "kind": "admin#reports#activity",
  "id": {
    "time": "2022-08-15T09:43:51.994Z",
    "uniqueQualifier": "-3118896930141663172",
    "applicationName": "token",
    "customerId": "C00mpaiwz"
  },
  "etag": "\"_ZVRqe-BUDYcYeOIPo-gm6Eh1QaGne4ACjHHI6qsr6A/uiM7zuJ9pZ4SKEqjFr_ANLNvdWU\"",
  "actor": {
    "email": "admin@cloud-response.com",
    "profileId": "111440584475724055600"
  },
  "events": [
    {
      "name": "revoke",
      "parameters": [
        {
          "name": "client_id",
          "value": "77185425430.apps.googleusercontent.com"
        },
        {
          "name": "app_name",
          "value": "Google Chrome"
        },
        {
          "name": "client_type",
          "value": "NATIVE_DESKTOP"
        },
        {
          "name": "scope_data",
          "multiMessageValue": [
            {
              "parameter": [
                {
                  "name": "scope_name",
                  "value": "https://www.google.com/accounts/OAuthLogin"
                },
                {
                  "name": "product_bucket",
                  "multiValue": [
                    "IDENTITY"
                  ]
                }
              ]
            }
          ]
        },
        {
          "name": "scope",
          "multiValue": [
            "https://www.google.com/accounts/OAuthLogin"
          ]
        }
      ]
    }
  ]
}

References #

activity: Token Activity

ApplicationName: token

Description

An OAuth-authorized application performed an API activity.

References #

Token Activity Events reference

deny: Deny OAuth Token

ApplicationName: token

Description

An OAuth token authorization request was denied.

References #

Token Activity Events reference

request: Request OAuth Token

ApplicationName: token

Description

An OAuth token authorization was requested by a third-party application.

References #

Token Activity Events reference

any: Token / OAuth (any event)

Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.

ApplicationName: token

Description

Source-only rules that filter on applicationName 'token' without specifying an eventName attribute here.

References #

Reports API: token activity events