Google Workspace OAuth Grant + App-Password Issuance After Suspicious AiTM Sign-In
Detects a Google Workspace OAuth application grant and application-specific password issuance occurring within 30 minutes of a suspicious/AiTM-flagged sign-in, indicating Gmail account takeover.
Microsoft Sentinel (KQL)
