Google Workspace Marketplace Allowlist Configuration

Severity: low
Type: Alert
Author: Google Cloud Security
Source: github.com/chronicle/detection-rules

Identifies when the Google Workspace Marketplace allowlist is configured to allow users to install and run any apps from the Marketplace. Allowing users to install and run any apps may increase the organization's risk of data exfiltration/leakage and increase its attack surface.

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1685` Disable or Modify Tools

Telemetry coverage

Platform	Record / event type
Google Workspace	CHANGE_APPLICATION_SETTING: Application Setting Change

Rules detecting the same action

These rules filter on the same operation.

Application Removed from Blocklist in Google Workspace (Elastic)
Google Workspace Bitlocker Setting Disabled (Elastic)
Google Workspace Gmail Routing or Forwarding Rule Created or Modified (Elastic)
Google Workspace Password Policy Changed (YARA-L)
Google Workspace Password Policy Modified (Elastic)
Google Workspace Restrictions for Marketplace Modified to Allow Any App (Elastic)
GSuite Workspace Gmail Pre-Delivery Message Scanning Disabled (Panther)
GSuite Workspace Gmail Security Sandbox Disabled (Panther)

Rule body

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule google_workspace_marketplace_allowlist_configuration {

  meta:
    author = "Google Cloud Security"
    description = "Identifies when the Google Workspace Marketplace allowlist is configured to allow users to install and run any apps from the Marketplace. Allowing users to install and run any apps may increase the organization's risk of data exfiltration/leakage and increase its attack surface."
    rule_id = "mr_3dd74ce1-27cb-4c57-b4cf-4cfb29293ab5"
    rule_name = "Google Workspace Marketplace Allowlist Configuration"
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "Impair Defenses: Disable or Modify Tools"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1562/001/"
    mitre_attack_version = "v13.1"
    type = "Alert"
    data_source = "Workspace Activity"
    severity = "Low"
    priority = "Low"

  events:
    $ws.metadata.vendor_name = "Google Workspace"
    $ws.metadata.product_name = "admin"
    $ws.metadata.product_event_type = "CHANGE_APPLICATION_SETTING"
    $ws.security_result.category_details = "APPLICATION_SETTINGS"
    $ws.target.application = "Google Workspace Marketplace"
    $ws.target.resource.name = "Apps Access Setting Allowlist access"
    $ws.target.resource.attribute.labels["new_value"] = "ALLOW_ALL"

  outcome:
    $risk_score = max(35)
    $mitre_attack_tactic = "Defense Evasion"
    $mitre_attack_technique = "Impair Defenses: Disable or Modify Tools"
    $mitre_attack_technique_id = "T1562.001"
    $event_count = count_distinct($ws.metadata.id)
    $principal_ip = array_distinct($ws.principal.ip)
    $principal_country = array_distinct($ws.principal.ip_geo_artifact.location.country_or_region)
    $principal_state = array_distinct($ws.principal.ip_geo_artifact.location.state)
    $principal_user_emails = array_distinct($ws.principal.user.email_addresses)
    $principal_user_id = array_distinct($ws.principal.user.userid)
    $target_application = $ws.target.application

  condition:
    $ws
}

YARA-L rule structure

Condition

Fires when at least one $ws event.

Events

`$ws`

metadata.product_event_type = "CHANGE_APPLICATION_SETTING"
security_result.category_details = "APPLICATION_SETTINGS"
target.application = "Google Workspace Marketplace"
target.resource.name = "Apps Access Setting Allowlist access"
target.resource.attribute.labels["new_value"] = "ALLOW_ALL"

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

Field	Expression
`risk_score`	`max(35)`
`event_count`	`count_distinct($ws.metadata.id)`
`principal_ip`	`array_distinct($ws.principal.ip)`
`principal_country`	`array_distinct($ws.principal.ip_geo_artifact.location.country_or_region)`
`principal_state`	`array_distinct($ws.principal.ip_geo_artifact.location.state)`
`principal_user_emails`	`array_distinct($ws.principal.user.email_addresses)`
`principal_user_id`	`array_distinct($ws.principal.user.userid)`
`target_application`	`$ws.target.application`