Google Workspace OAuth Application Authorization Spike
Detects anomalous OAuth application authorization behavior by a user, specifically monitoring for a spike in authorization events within a short timeframe. This activity is often indicative of consent phishing campaigns where an adversary tricks a user into granting excessive application permissions to a malicious OAuth app, or a compromised account performing bulk authorization grants.
Cortex XDR
