OAuth Token Theft in Google Workspace: Detecting and Breaking the Modern Attack Chain

---
title: Suspicious OAuth Application Grant in Google Workspace
id: 3b8f2e71-6c4a-4d9b-a512-9e7c5f1a8d02
status: experimental
description: Detects OAuth authorization grants to unverified or rarely seen third-party applications in Google Workspace, a common entry point for token-based compromise and consent phishing.
references:
  - https://www.bleepingcomputer.com/news/security/the-modern-attack-chain-rethinking-google-workspace-security-in-the-age-of-ai/
  - https://attack.mitre.org/techniques/T1550/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.persistence
  - attack.t1550.001
  - attack.t1528
logsource:
  product: google_workspace
  service: token
detection:
  selection:
    eventName: authorize
  filter_known_apps:
    applicationName|contains:
      - 'Google'
      - 'Microsoft'
      - 'Zoom'
      - 'Slack'
      - 'Salesforce'
  condition: selection and not filter_known_apps
falsepositives:
  - Legitimate new SaaS onboarding; maintain an allowlist of approved application names and client IDs
level: medium
---
title: Gmail Delegation or Forwarding Configuration Added
id: 91c4d6a2-2f58-4b1e-9c37-4a6b8d0e5f13
status: experimental
description: Detects creation of Gmail forwarding addresses, mail delegation, or send-as configuration changes, frequently used by attackers for persistence and silent exfiltration after token-based mailbox access.
references:
  - https://www.bleepingcomputer.com/news/security/the-modern-attack-chain-rethinking-google-workspace-security-in-the-age-of-ai/
  - https://attack.mitre.org/techniques/T1114/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.exfiltration
  - attack.t1114.003
logsource:
  product: google_workspace
  service: admin
detection:
  selection:
    eventName|contains:
      - 'EMAIL_FORWARDING'
      - 'DELEGATE'
      - 'SEND_AS'
      - 'CHANGE_GMAIL_SETTING'
  condition: selection
falsepositives:
  - Executive assistant delegation and legitimate user-configured forwarding; correlate with change tickets
level: high
---
title: Infostealer-Style Access to Browser Credential Stores
id: 5f2a9c84-1d37-4e6b-b208-7c3e9a4f6b51
status: experimental
description: Detects non-browser processes reading Chrome or Edge cookie and login-data stores, a hallmark of infostealers harvesting session tokens later replayed against Google Workspace.
references:
  - https://www.bleepingcomputer.com/news/security/the-modern-attack-chain-rethinking-google-workspace-security-in-the-age-of-ai/
  - https://attack.mitre.org/techniques/T1539/
  - https://attack.mitre.org/techniques/T1555.003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1539
  - attack.t1555.003
logsource:
  category: file_access
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\AppData\Local\Google\Chrome\User Data\'
      - '\AppData\Local\Microsoft\Edge\User Data\'
  selection_file:
    TargetFilename|endswith:
      - '\Cookies'
      - '\Login Data'
      - '\Web Data'
      - '\Local State'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\MsMpEng.exe'
  condition: selection_path and selection_file and not filter_browsers
falsepositives:
  - EDR/AV scanners and backup agents; exclude by known process hash or path after tuning
level: high

// Hunt 1: OAuth grants to unverified/new apps followed by anomalous token use
GWorkspaceActivityReports
| where TimeGenerated > ago(14d)
| where EventName =~ "authorize"
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Users=make_set(ActorEmail, 50)
  by ClientId = tostring(ExtendedProperties.client_id), AppName = tostring(ExtendedProperties.app_name), Scope = tostring(ExtendedProperties.scope)
| where Scope has_any ("mail.google.com", "gmail.readonly", "drive", "admin.directory")
| order by FirstSeen asc;

// Hunt 2: Gmail session activity from an IP/ASN never seen for that user (token replay)
GWorkspaceActivityReports
| where TimeGenerated > ago(30d)
| where isnotempty(IpAddress)
| summarize IPs=make_set(IpAddress) by ActorEmail;
// Correlate the output against a 90-day baseline table of known user IPs;
// flag sessions whose IP appears in the 30-day set but not the 90-day baseline.

// Hunt 3: Endpoint side - non-browser process touching browser cookie stores
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FolderPath has_any ("\\Google\\Chrome\\User Data\\", "\\Microsoft\\Edge\\User Data\\")
| where FileName in~ ("Cookies", "Login Data", "Local State", "Web Data")
| where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "MsMpEng.exe", "MsSense.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, FileName
| order by TimeGenerated desc;

-- Hunt for non-browser processes with open handles to browser token stores
-- Deploy as a hunt across Windows fleets where infostealer activity is suspected
SELECT Pid,
       Name,
       Exe,
       CommandLine,
       Username,
       CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(cookies|login data|local state)'
   OR Exe =~ '(?i)(appdata|temp|programdata)\\\\[^\\\\]+\.exe$'

-- Companion artifact: enumerate recent modifications to Chrome token stores
SELECT FullPath,
       Size,
       Mtime,
       Ctime
FROM glob(globs='C:/Users/*/AppData/Local/Google/Chrome/User Data/*/Network/Cookies')
WHERE Mtime > now() - 86400
ORDER BY Mtime DESC

#!/usr/bin/env bash
# Workspace OAuth grant audit + emergency token revocation
# Requires: GAMADV-XTD3 (https://github.com/taers232c/GAMADV-XTD3) with admin credentials
set -euo pipefail

GAM="$HOME/bin/gam/gam"
HIGH_RISK_SCOPES="mail.google.com|gmail.readonly|gmail.modify|drive|admin.directory"
REPORT="oauth_grant_audit_$(date +%Y%m%d).csv"

echo "[*] Exporting all user OAuth token grants..."
$GAM print users all fields primaryemail > /tmp/ws_users.csv
tail -n +2 /tmp/ws_users.csv | cut -d, -f1 | while read -r user; do
  $GAM user "$user" print tokens >> "$REPORT" 2>/dev/null || true
done

echo "[*] Flagging grants with high-risk scopes..."
grep -Ei "$HIGH_RISK_SCOPES" "$REPORT" | sort -u > high_risk_grants.txt || true
cat high_risk_grants.txt

echo "[*] Emergency revocation (run manually for a confirmed-compromised user):"
echo "    # Revoke ALL third-party tokens for the user"
echo "    $GAM user victim@example.com deprovision"
echo "    # Or surgically: revoke a specific client ID"
echo "    $GAM user victim@example.com delete token client <CLIENT_ID>"
echo "    # Force global session invalidation (kills refresh-token replay)"
echo "    $GAM user victim@example.com signout"
echo "    # Suspend while investigating"
echo "    $GAM update user victim@example.com suspended on"

echo "[*] Checking for users with forwarding enabled (exfil indicator)..."
tail -n +2 /tmp/ws_users.csv | cut -d, -f1 | while read -r user; do
  fwd=$($GAM user "$user" show forwarding 2>/dev/null | grep -i "enabled" || true)
  [ -n "$fwd" ] && echo "FORWARDING ENABLED: $user"
done

echo "[+] Done. Review high_risk_grants.txt and forwarding output before revoking en masse."