Google Workspace Bulk OAuth Token Revocation

Detects mass revocation of OAuth tokens by a user, which may indicate an attacker cleaning up evidence after data extraction, or legitimate administrative incident response activity.