From caa47051334613262031da9f2ee7266b6e02dc4d Mon Sep 17 00:00:00 2001 From: Samirbous <64742097+Samirbous@users.noreply.github.com> Date: Mon, 18 May 2026 11:28:30 +0100 Subject: [PATCH] [New] Google Workspace Device Registration from Suspicious ASN (#6158) * [New] Google Workspace Device Registration After OAuth from Suspicious ASN Detects when a Google Workspace account completes OAuth authorization for a specific Google OAuth client from a high-risk autonomous system number (ASN), followed within 30 seconds by a device registration event with account state REGISTERED. This sequence can indicate device enrollment or join flows initiated from attacker-controlled or residential-proxy infrastructure after a user authorizes a sensitive client. * Update persistence_google_workspace_device_registered_after_oauth_from_suspicious_asn.toml --- detection_rules/etc/non-ecs-schema.json | 3 +- ...tered_after_oauth_from_suspicious_asn.toml | 123 ++++++++++++++++++ 2 files changed, 125 insertions(+), 1 deletion(-) create mode 100644 rules/integrations/google_workspace/persistence_google_workspace_device_registered_after_oauth_from_suspicious_asn.toml diff --git a/detection_rules/etc/non-ecs-schema.json b/detection_rules/etc/non-ecs-schema.json index 24910383a..6911fb540 100644 --- a/detection_rules/etc/non-ecs-schema.json +++ b/detection_rules/etc/non-ecs-schema.json @@ -181,7 +181,8 @@ "google_workspace.drive.visibility": "keyword", "google_workspace.token.client.id": "keyword", "google_workspace.token.scope.data": "keyword", - "google_workspace.token.scope.data.scope_name": "keyword" + "google_workspace.token.scope.data.scope_name": "keyword", + "google_workspace.device.account_state": "keyword" }, "logs-ti_*": { "labels.is_ioc_transform_source": "keyword" diff --git a/rules/integrations/google_workspace/persistence_google_workspace_device_registered_after_oauth_from_suspicious_asn.toml b/rules/integrations/google_workspace/persistence_google_workspace_device_registered_after_oauth_from_suspicious_asn.toml new file mode 100644 index 000000000..0305a3bc4 --- /dev/null +++ b/rules/integrations/google_workspace/persistence_google_workspace_device_registered_after_oauth_from_suspicious_asn.toml @@ -0,0 +1,123 @@ +[metadata] +creation_date = "2026/05/15" +integration = ["google_workspace"] +maturity = "production" +updated_date = "2026/05/15" + +[rule] +author = ["Elastic"] +description = """ +Detects when a Google Workspace account completes OAuth authorization for a specific Google OAuth client from a +high-risk autonomous system number (ASN), followed within 30 seconds by a device registration event with account state +REGISTERED. This sequence can indicate device enrollment or join flows initiated from attacker-controlled or +residential-proxy infrastructure after a user authorizes a sensitive client. +""" +false_positives = [ + """ + Users on VPNs, carrier NAT, or cloud egress that map to flagged ASNs may match. Legitimate bulk enrollment or + scripted onboarding that uses the same OAuth client can also produce the sequence. Baseline `source.as.organization.name` + and successful registration sources before adding exclusions. + """, +] +from = "now-15m" +index = ["logs-google_workspace*"] +interval = "5m" +language = "eql" +license = "Elastic License v2" +name = "Google Workspace Device Registration After OAuth from Suspicious ASN" +note = """## Triage and analysis + +### Investigating Google Workspace Device Registration After OAuth from Suspicious ASN + +Review `user.name`, `user.email`, `source.ip`, `source.as.organization.name`, `google_workspace.token.client.id`, +`google_workspace.token.app_name`, and device fields on the second event (for example device display name or ID if +present in your schema). + +Confirm whether the user intentionally registered a device and whether the OAuth client and ASN are expected for your +mobile device management or enrollment program. + +### Possible investigation steps + +- Correlate both events on `user.name` and timestamps to confirm the sequence is a single enrollment story. +- Revoke or audit OAuth grants for the client if the authorization was not expected. +- Search for additional `google_workspace.device` registrations from the same ASN in the same period. + +### Response and remediation + +- If malicious, remove the unauthorized device from the Google Admin console, reset the user password, and revoke + active sessions and tokens per incident policy. +- Restrict device registration and review OAuth app access policies. + +## Setup + +The Google Workspace Fleet integration or Filebeat Google Workspace module must ingest `google_workspace.token` and +`google_workspace.device` audit streams. + +### Event lag + +Google Workspace audit data can lag minutes to days behind real time. If sequences are missed, increase `from` and +lower the integration poll interval per Google and Elastic documentation. +""" +references = [ + "https://www.elastic.co/security-labs/google-workspace-attack-surface-part-one", + "https://support.google.com/a/answer/7061566", +] +risk_score = 73 +rule_id = "012bfca7-45cb-4507-a3ba-3777167f8b81" +severity = "high" +tags = [ + "Domain: Cloud", + "Data Source: Google Workspace", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Tactic: Initial Access", + "Threat: Tycoon2FA", + "Resources: Investigation Guide", +] +timestamp_override = "event.ingested" +type = "eql" + +query = ''' +sequence by user.name with maxspan=30s + [iam where data_stream.dataset == "google_workspace.token" and event.action == "authorize" and + google_workspace.token.client.id == "77185425430.apps.googleusercontent.com" and + source.as.number in (9009, 45102, 215540, 29802, 62240, 204957, 395092)] + [any where data_stream.dataset == "google_workspace.device" and google_workspace.device.account_state == "REGISTERED"] +''' + + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1098" +name = "Account Manipulation" +reference = "https://attack.mitre.org/techniques/T1098/" + +[[rule.threat.technique.subtechnique]] +id = "T1098.005" +name = "Device Registration" +reference = "https://attack.mitre.org/techniques/T1098/005/" + +[rule.threat.tactic] +id = "TA0003" +name = "Persistence" +reference = "https://attack.mitre.org/tactics/TA0003/" + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1566" +name = "Phishing" +reference = "https://attack.mitre.org/techniques/T1566/" + +[[rule.threat.technique.subtechnique]] +id = "T1566.002" +name = "Spearphishing Link" +reference = "https://attack.mitre.org/techniques/T1566/002/" + +[rule.threat.tactic] +id = "TA0001" +name = "Initial Access" +reference = "https://attack.mitre.org/tactics/TA0001/"