Google Workspace Atomic Tests by ATT&CK Tactic & Technique

credential-access

• T1110.001 Brute Force: Password Guessing CONTRIBUTE A TEST
• T1539 Steal Web Session Cookie CONTRIBUTE A TEST
• T1606.002 Forge Web Credentials: SAML token CONTRIBUTE A TEST
• T1552 Unsecured Credentials CONTRIBUTE A TEST
• T1556.007 Hybrid Identity CONTRIBUTE A TEST
• T1110.003 Brute Force: Password Spraying CONTRIBUTE A TEST
• T1528 Steal Application Access Token CONTRIBUTE A TEST
• T1606 Forge Web Credentials CONTRIBUTE A TEST
• T1621 Multi-Factor Authentication Request Generation CONTRIBUTE A TEST
• T1552.008 Chat Messages CONTRIBUTE A TEST
• T1110 Brute Force CONTRIBUTE A TEST
• T1110.004 Brute Force: Credential Stuffing CONTRIBUTE A TEST
• T1556.006 Multi-Factor Authentication CONTRIBUTE A TEST
• T1556 Modify Authentication Process CONTRIBUTE A TEST

impact

• T1498.001 Direct Network Flood CONTRIBUTE A TEST
• T1499.003 Application Exhaustion Flood CONTRIBUTE A TEST
• T1499.004 Application or System Exploitation CONTRIBUTE A TEST
• T1498.002 Reflection Amplification CONTRIBUTE A TEST
• T1499.002 Service Exhaustion Flood CONTRIBUTE A TEST
• T1657 Financial Theft CONTRIBUTE A TEST
• T1499 Endpoint Denial of Service CONTRIBUTE A TEST
• T1498 Network Denial of Service CONTRIBUTE A TEST

defense-evasion

• T1564.008 Email Hiding Rules CONTRIBUTE A TEST
• T1070.008 Email Collection: Mailbox Manipulation CONTRIBUTE A TEST
• T1550 Use Alternate Authentication Material CONTRIBUTE A TEST
• T1556.007 Hybrid Identity CONTRIBUTE A TEST
• T1078.001 Valid Accounts: Default Accounts CONTRIBUTE A TEST
• T1548 Abuse Elevation Control Mechanism CONTRIBUTE A TEST
• T1548.005 Temporary Elevated Cloud Access CONTRIBUTE A TEST
• T1070 Indicator Removal on Host CONTRIBUTE A TEST
• T1078 Valid Accounts CONTRIBUTE A TEST
• T1556.006 Multi-Factor Authentication CONTRIBUTE A TEST
• T1550.004 Web Session Cookie CONTRIBUTE A TEST
• T1656 Impersonation CONTRIBUTE A TEST
• T1562.008 Impair Defenses: Disable Cloud Logs CONTRIBUTE A TEST
• T1550.001 Application Access Token CONTRIBUTE A TEST
• T1078.004 Valid Accounts: Cloud Accounts
  • Atomic Test #1: Creating GCP Service Account and Service Account Key [google-workspace, iaas:gcp]
• T1556 Modify Authentication Process CONTRIBUTE A TEST

discovery

• T1069 Permission Groups Discovery CONTRIBUTE A TEST
• T1069.003 Cloud Groups CONTRIBUTE A TEST
• T1087.003 Email Account CONTRIBUTE A TEST
• T1087 Account Discovery CONTRIBUTE A TEST
• T1087.004 Cloud Account CONTRIBUTE A TEST
• T1526 Cloud Service Discovery CONTRIBUTE A TEST
• T1538 Cloud Service Dashboard CONTRIBUTE A TEST

collection

• T1114 Email Collection CONTRIBUTE A TEST
• T1530 Data from Cloud Storage Object CONTRIBUTE A TEST
• T1114.003 Email Collection: Email Forwarding Rule CONTRIBUTE A TEST
• T1114.002 Email Collection: Remote Email Collection CONTRIBUTE A TEST
• T1213 Data from Information Repositories CONTRIBUTE A TEST

initial-access

• T1566.002 Spearphishing Link CONTRIBUTE A TEST
• T1078.001 Valid Accounts: Default Accounts CONTRIBUTE A TEST
• T1566 Phishing CONTRIBUTE A TEST
• T1078 Valid Accounts CONTRIBUTE A TEST
• T1566.004 Spearphishing Voice CONTRIBUTE A TEST
• T1078.004 Valid Accounts: Cloud Accounts
  • Atomic Test #1: Creating GCP Service Account and Service Account Key [google-workspace, iaas:gcp]

persistence

• T1098.003 Account Manipulation: Additional Cloud Roles CONTRIBUTE A TEST
• T1556.007 Hybrid Identity CONTRIBUTE A TEST
• T1078.001 Valid Accounts: Default Accounts CONTRIBUTE A TEST
• T1136.003 Create Account: Cloud Account CONTRIBUTE A TEST
• T1098 Account Manipulation CONTRIBUTE A TEST
• T1078 Valid Accounts CONTRIBUTE A TEST
• T1556.006 Multi-Factor Authentication CONTRIBUTE A TEST
• T1136 Create Account CONTRIBUTE A TEST
• T1098.002 Account Manipulation: Additional Email Delegate Permissions CONTRIBUTE A TEST
• T1078.004 Valid Accounts: Cloud Accounts
  • Atomic Test #1: Creating GCP Service Account and Service Account Key [google-workspace, iaas:gcp]
• T1556 Modify Authentication Process CONTRIBUTE A TEST

privilege-escalation

• T1098.003 Account Manipulation: Additional Cloud Roles CONTRIBUTE A TEST
• T1078.001 Valid Accounts: Default Accounts CONTRIBUTE A TEST
• T1548 Abuse Elevation Control Mechanism CONTRIBUTE A TEST
• T1548.005 Temporary Elevated Cloud Access CONTRIBUTE A TEST
• T1098 Account Manipulation CONTRIBUTE A TEST
• T1078 Valid Accounts CONTRIBUTE A TEST
• T1098.002 Account Manipulation: Additional Email Delegate Permissions CONTRIBUTE A TEST
• T1078.004 Valid Accounts: Cloud Accounts
  • Atomic Test #1: Creating GCP Service Account and Service Account Key [google-workspace, iaas:gcp]

exfiltration

• T1567 Exfiltration Over Web Service CONTRIBUTE A TEST
• T1567.004 Exfiltration Over Webhook CONTRIBUTE A TEST
• T1048 Exfiltration Over Alternative Protocol CONTRIBUTE A TEST
• T1537 Transfer Data to Cloud Account CONTRIBUTE A TEST

lateral-movement

• T1550 Use Alternate Authentication Material CONTRIBUTE A TEST
• T1021.007 Cloud Services CONTRIBUTE A TEST
• T1534 Internal Spearphishing CONTRIBUTE A TEST
• T1550.004 Web Session Cookie CONTRIBUTE A TEST
• T1550.001 Application Access Token CONTRIBUTE A TEST

execution

• T1059.009 Cloud API CONTRIBUTE A TEST
• T1059 Command and Scripting Interpreter CONTRIBUTE A TEST