From 3cd43bfd9b04f18fb84620a853f74351e62700a3 Mon Sep 17 00:00:00 2001
From: Austin Songer <austin@songer.pro>
Date: Mon, 23 Aug 2021 21:19:44 -0500
Subject: [PATCH] Create gworkspace_granted_domain_api_access.yml

---
 .../gworkspace_granted_domain_api_access.yml  | 23 +++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100644 rules/cloud/gworkspace/gworkspace_granted_domain_api_access.yml

diff --git a/rules/cloud/gworkspace/gworkspace_granted_domain_api_access.yml b/rules/cloud/gworkspace/gworkspace_granted_domain_api_access.yml
new file mode 100644
index 000000000..8857a8749
--- /dev/null
+++ b/rules/cloud/gworkspace/gworkspace_granted_domain_api_access.yml
@@ -0,0 +1,23 @@
+title: Google Workspace Granted Domain API Access
+id: 04e2a23a-9b29-4a5c-be3a-3542e3f982ba
+description: Detects when an API access service account is granted domain authority.
+author: Austin Songer
+status: experimental
+date: 2021/08/23
+references:
+    - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3
+    - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-user-settings#AUTHORIZE_API_CLIENT_ACCESS
+logsource:
+  service: google_workspace.admin
+detection:
+    selection:
+        eventService: admin.googleapis.com
+        eventName: AUTHORIZE_API_CLIENT_ACCESS
+    condition: selection
+level: medium
+tags:
+    - attack.persistence
+    - atack.t1098
+falsepositives:
+ - Unknown
+