Google Workspace Domain-Wide API Access Granted

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•2•0•904

Detects when an API access service account is granted domain authority within Google Workspace. This action can be used by an attacker to gain persistent and elevated access to an organization's Google Workspace data and services by allowing a service account to impersonate users across the domain.