6 detection rules reference this catalog entry. View catalog entry.Elastic (4)
- First Time Seen Google Workspace OAuth Login from Third-Party Application severity medium T1078,T1078.004,T1550,T1550.001
- Google Workspace Device Registration After OAuth from Suspicious ASN severity high T1098,T1098.005,T1566,T1566.002
- Google Workspace Object Copied from External Drive with App Consent severity high T1098,T1098.001,T1204,T1204.001,T1566,T1566.002
- Google Workspace User Login with Unusual ASN severity low T1078,T1078.004,T1528,T1557