Google Workspace OAuth Application Authorized with Privileged Scopes
Description
Detects when a user authorizes an OAuth application with privileged scopes in Google Workspace. Privileged scopes grant broad access to sensitive data and administrative functions.
Query · python
from panther_gsuite_helpers import gsuite_parameter_lookup
PRIVILEGED_SCOPES = [
"admin.directory.user",
"admin.directory.group",
"admin.directory.domain",
"ediscovery",
"vault",
"cloud_search.query",
]
def rule(event):
scopes = event.deep_get("parameters", "scope", default=[])
app_name = event.deep_get("id", "applicationName", default="")
event_name = event.get("name")
if app_name != "token" or event_name != "authorize":
return False
# Handle both list and string formats
if scopes and isinstance(scopes, str):
scopes = [scopes]
# Check if any scope matches privileged scopes
privileged_scopes_lower = [ps.lower() for ps in PRIVILEGED_SCOPES]
for scope_url in scopes:
# Extract the last part of the scope URL (e.g., "admin.directory.user" from full URL)
scope_name = scope_url.split("/")[-1].lower()
if scope_name in privileged_scopes_lower:
return True
return False
def title(event):
actor = event.deep_get("actor", "email", default="<UNKNOWN_USER>")
app_name = event.deep_get("parameters", "app_name", default="<UNKNOWN_APP>")
return (
f"Google Workspace: User [{actor}] authorized OAuth app [{app_name}] with privileged scopes"
)
def alert_context(event):
parameters = event.get("parameters", {})
return {
"actor": event.deep_get("actor", "email", default=""),
"app_name": gsuite_parameter_lookup(parameters, "app_name"),
"client_id": gsuite_parameter_lookup(parameters, "client_id"),
"client_type": gsuite_parameter_lookup(parameters, "client_type"),
"scopes": gsuite_parameter_lookup(parameters, "scope"),
"scope_data": gsuite_parameter_lookup(parameters, "scope_data"),
"event_type": event.get("name"),
"ip_address": event.get("ipAddress"),
}
Analyst notes
- Query GSuite.ActivityEvent logs for all OAuth token authorize events by actor:email in the 7 days before and after this alert to identify if this is part of a pattern of suspicious OAuth grants
- Search for the parameters:client_id across all users in the organization to determine if other users also authorized the same application
- Review audit logs for any actions taken using the OAuth token between the authorization timestamp and now, filtering by parameters:app_name and the authorized scopes