Analytics BIOC
Low
✕
A domain was added to the trusted domains list
A domain was added to the Google Workspace trusted domains list.
- Module:
- Identity Threat Detection (ITDR), SaaS Threat Detection
- Licensed by:
- Identity Threat Detection (ITDR)
- Data source:
- Google Workspace Audit Logs
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Impair Defenses (T1562) Domain or Tenant Policy Modification: Trust Modification (T1484.002)
Detector tags: Google Workspace
Attacker's goals:
An adversary may add a trusted domain to collect and exfiltrate data from their target's organization with less restrictive security controls.
Investigative actions:
Check if the identity intended to perform this action or look for signs that the user account is compromised (e.g. abnormal logins, unusual activity). Investigate the new domain in the trusted domains list. Follow further actions done by the account.
- Test period:
- N/A (single event)
- Deduplication:
- 5 Days
2 variations:
- A domain was added to the trusted domains list by a non Google Workspace administrative user Low
- A domain was added to the trusted domains list from an unusual ASN Low