Analytics BIOC
Informational
✕
An app was added to Google Marketplace
An app was added to the Google Workspace Marketplace.
- Module:
- Identity Threat Detection (ITDR), SaaS Threat Detection
- Licensed by:
- Identity Threat Detection (ITDR)
- Data source:
- Google Workspace Audit Logs
ATT&CK tactics: Command and Control (TA0011)
ATT&CK techniques: Remote Access Tools (T1219)
Detector tags: Google Workspace
Attacker's goals:
An adversary may add a malicious application to an organization's Google Workspace domain to maintain a presence in their target's organization and steal data.
Investigative actions:
Check if the identity intended to perform this action or look for signs that the user account is compromised (e.g. abnormal logins, unusual activity). Investigate the new app that was added to Google workspace Marketplace. Follow further actions done by the account.
- Test period:
- N/A (single event)
- Deduplication:
- 5 Days
3 variations:
- An app was added to Google Marketplace by a non-administrative identity Informational
- An app was added to Google Marketplace from an unusual ASN Low (parent: Informational)
- An unusual app was added to Google Marketplace Low (parent: Informational)