Blog
Practitioner guides to investigating Google Workspace compromises: audit log exports, BEC forwarding rules, OAuth apps, Drive exfiltration, admin changes.
What Google Workspace audit logs can't tell you: 6-month retention, lag times, export row caps, CSV vs Reports API fields, license gaps and other blind spots.
A fictional business email compromise in Google Workspace, worked from the audit logs: AiTM sign-in, OAuth grant, hidden filter, fraud mail and Drive theft.
A first-hour checklist for a compromised Google Workspace account: preserve logs, cut sessions and OAuth tokens, remove forwarding and filters, stop payments.
If a Google Workspace super admin is compromised: Admin log events for new admins, role grants, SSO changes, delegation, mail routing and compliance rules.
Detect data theft in Google Workspace: Drive mass download bursts, external sharing, public links, owner transfers and Google Takeout exports in audit logs.
Domain-wide delegation security risks: how an API client can impersonate every user, the Admin log events that record it, DeleFriend and what to review.
Investigate a suspicious OAuth app in Google Workspace: read token log authorize and activity events, judge Gmail and Drive scopes, revoke and block the app.
How to find the Gmail forwarding rule or hidden filter a hacker left in a Workspace mailbox: the log events, the Gmail settings to export and what to delete.
Investigate a Google Workspace suspicious login: is_suspicious, hosting ASNs, new countries, impossible travel, failed-login bursts, 2SV and recovery changes.