Detectionmediumtest

Google Workspace Role Privilege Deleted

Detects when an a role privilege is deleted in Google Workspace.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Austin SongerCreated Tue Aug 24Updated Wed Oct 11bf638ef7-4d2d-44bb-a1dc-a238252e6267cloud

Log Source

Google Cloudgoogle_workspace.admin

ProductGoogle Cloud← raw: gcp

Servicegoogle_workspace.admin← raw: google_workspace.admin

Detection Logic

detection:
    selection:
        eventService: admin.googleapis.com
        eventName: REMOVE_PRIVILEGE
    condition: selection

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

Rule Metadata

Rule ID

bf638ef7-4d2d-44bb-a1dc-a238252e6267

Status

test

Level

medium

Type

Detection

Created

Tue Aug 24

Modified

Wed Oct 11

Author

Path

rules/cloud/gcp/gworkspace/gcp_gworkspace_role_privilege_deleted.yml

Raw Tags

attack.impact