Analytics BIOC
Informational
✕
Gmail delegation was turned on for the organization
A Google Workspace admin turned on Gmail delegation for all the organization's users.
- Module:
- Identity Threat Detection (ITDR), SaaS Threat Detection
- Licensed by:
- Identity Threat Detection (ITDR)
- Data source:
- Google Workspace Audit Logs
ATT&CK tactics: Privilege Escalation (TA0004)
ATT&CK techniques: Domain or Tenant Policy Modification (T1484)
Detector tags: Google Workspace
Attacker's goals:
Email Collection.
Investigative actions:
Check if the identity intended to perform this action or look for signs that the user account is compromised (e.g. abnormal logins, unusual activity). Check if any user in the organization granted other users access to their mail inbox. Follow further actions done by the account.
- Test period:
- N/A (single event)
- Deduplication:
- 5 Days