GTRADE-001: Domain-Wide Delegation Org-Takeover Exposure
- Plataforma
- Google Workspace
- Categoría
- Adversary Tradecraft
- Severidad
- Critical
- Pilar de Zero Trust
- Visibility & Analytics (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- original
Qué comprueba
Domain-wide delegation binds impersonation to a service account's OAuth client ID, not its key — so anyone who can mint a key on a delegated SA holding broad scopes gains org-wide impersonation without super admin (the DeleFriend technique). Delegated grants carrying full Gmail/Drive/Directory/cloud-platform scopes are the takeover precondition.
Valor recomendado
No service account delegated org-impersonation scopes (full Gmail/Drive/Directory/cloud-platform); narrow read-only scopes only
Remediación
Security > API controls > Domain-wide delegation: remove or narrow any grant holding full mail.google.com, full drive, admin.directory, or cloud-platform scopes; restrict to the minimum read-only scopes required. In GCP, deny key creation on delegated service accounts (iam.disableServiceAccountKeyCreation).
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6, IA-2, AC-6(5)
- CIS Benchmark
- 1.x
- MITRE ATT&CK
- T1078.004, T1098