google_workspace_marketplace_allowlist_configuration

rule google_workspace_marketplace_allowlist_configuration {

  meta:
    author = "Google Cloud Security"
    description = "Identifies when the Google Workspace Marketplace allowlist is configured to allow users to install and run any apps from the Marketplace. Allowing users to install and run any apps may increase the organization's risk of data exfiltration/leakage and increase its attack surface."
    rule_id = "mr_3dd74ce1-27cb-4c57-b4cf-4cfb29293ab5"
    rule_name = "Google Workspace Marketplace Allowlist Configuration"
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "Impair Defenses: Disable or Modify Tools"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1562/001/"
    mitre_attack_version = "v13.1"
    type = "Alert"
    data_source = "Workspace Activity"
    severity = "Low"
    priority = "Low"

  events:
    $ws.metadata.vendor_name = "Google Workspace"
    $ws.metadata.product_name = "admin"
    $ws.metadata.product_event_type = "CHANGE_APPLICATION_SETTING"
    $ws.security_result.category_details = "APPLICATION_SETTINGS"
    $ws.target.application = "Google Workspace Marketplace"
    $ws.target.resource.name = "Apps Access Setting Allowlist access"
    $ws.target.resource.attribute.labels["new_value"] = "ALLOW_ALL"

  outcome:
    $risk_score = max(35)
    $mitre_attack_tactic = "Defense Evasion"
    $mitre_attack_technique = "Impair Defenses: Disable or Modify Tools"
    $mitre_attack_technique_id = "T1562.001"
    $event_count = count_distinct($ws.metadata.id)
    $principal_ip = array_distinct($ws.principal.ip)
    $principal_country = array_distinct($ws.principal.ip_geo_artifact.location.country_or_region)
    $principal_state = array_distinct($ws.principal.ip_geo_artifact.location.state)
    $principal_user_emails = array_distinct($ws.principal.user.email_addresses)
    $principal_user_id = array_distinct($ws.principal.user.userid)
    $target_application = $ws.target.application

  condition:
    $ws
}