An app was removed from a blocked list in Google Workspace

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-09-24

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	2 Days
Required Data	Requires: Google Workspace Audit Logs
Detection Modules	Identity Threat Module
Detector Tags
ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Modify Authentication Process (T1556)
Severity	Informational

An identity removed an app from Google Workspace blocked OAuth or third-party apps list.

Malicious OAuth Apps can be used to request elevated permissions or to impersonate another user.

Check if the identity intended to perform this action, or look for signs that the user account is compromised (e.g. abnormal logins, unusual activity).
Check if the app that was removed from the trusted apps list looks suspicious.
Follow further actions done by the account.

ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Modify Authentication Process (T1556)
Severity	Low

An identity removed an app from Google Workspace blocked OAuth or third-party apps list.

Malicious OAuth Apps can be used to request elevated permissions or to impersonate another user.

Check if the identity intended to perform this action, or look for signs that the user account is compromised (e.g. abnormal logins, unusual activity).
Check if the app that was removed from the trusted apps list looks suspicious.
Follow further actions done by the account.

ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Modify Authentication Process (T1556)
Severity	Low

An identity removed an app from Google Workspace blocked OAuth or third-party apps list.

Malicious OAuth Apps can be used to request elevated permissions or to impersonate another user.

Check if the identity intended to perform this action, or look for signs that the user account is compromised (e.g. abnormal logins, unusual activity).
Check if the app that was removed from the trusted apps list looks suspicious.
Follow further actions done by the account.

ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Modify Authentication Process (T1556)
Severity	Low

An identity removed an app from Google Workspace blocked OAuth or third-party apps list.

Malicious OAuth Apps can be used to request elevated permissions or to impersonate another user.

Check if the identity intended to perform this action, or look for signs that the user account is compromised (e.g. abnormal logins, unusual activity).
Check if the app that was removed from the trusted apps list looks suspicious.
Follow further actions done by the account.