Google Workspace third-party application's security settings were changed

Synopsis

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	2 Days
Required Data	Requires: Google Workspace Audit Logs
Detection Modules	Identity Threat Module
ATT&CK Tactic	Privilege Escalation (TA0004)
ATT&CK Technique	Domain Policy Modification (T1484)
Severity	Informational

An identity changed Google Workspace third-party application's security settings.

Malicious Apps can be used to access the organization's Google data.

Check if the identity intended to perform this action, or look for signs that the user account is compromised (e.g. abnormal logins, unusual activity).
Check if the new settings look suspicious.
Follow further actions done by the account.

ATT&CK Tactic	Privilege Escalation (TA0004)
ATT&CK Technique	Domain Policy Modification (T1484)
Severity	Low

An identity changed Google Workspace third-party application's security settings.

Malicious Apps can be used to access the organization's Google data.

Check if the identity intended to perform this action, or look for signs that the user account is compromised (e.g. abnormal logins, unusual activity).
Check if the new settings look suspicious.
Follow further actions done by the account.

ATT&CK Tactic	Privilege Escalation (TA0004)
ATT&CK Technique	Domain Policy Modification (T1484)
Severity	Low

An identity changed Google Workspace third-party application's security settings.

Malicious Apps can be used to access the organization's Google data.

Check if the identity intended to perform this action, or look for signs that the user account is compromised (e.g. abnormal logins, unusual activity).
Check if the new settings look suspicious.
Follow further actions done by the account.

ATT&CK Tactic	Privilege Escalation (TA0004)
ATT&CK Technique	Domain Policy Modification (T1484)
Severity	Informational

An identity changed Google Workspace third-party application's security settings.

Malicious Apps can be used to access the organization's Google data.

Check if the identity intended to perform this action, or look for signs that the user account is compromised (e.g. abnormal logins, unusual activity).
Check if the new settings look suspicious.
Follow further actions done by the account.