Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionmediumtest

Google Workspace Application Removed

Detects when an an application is removed from Google Workspace.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Austin SongerCreated Thu Aug 26Updated Wed Oct 11ee2803f0-71c8-4831-b48b-a1fc57601ee4cloud
Log Source
Google Cloudgoogle_workspace.admin
ProductGoogle Cloud← raw: gcp
Servicegoogle_workspace.admin← raw: google_workspace.admin
Detection Logic
Detection Logic1 selector
detection:
    selection:
        eventService: admin.googleapis.com
        eventName:
            - REMOVE_APPLICATION
            - REMOVE_APPLICATION_FROM_WHITELIST
    condition: selection
False Positives

Application being removed may be performed by a System Administrator.

References
1
Resolving title…
cloud.google.com
2
Resolving title…
developers.google.com
3
Resolving title…
developers.google.com
MITRE ATT&CK
Rule Metadata
Rule ID
ee2803f0-71c8-4831-b48b-a1fc57601ee4
Status
test
Level
medium
Type
Detection
Created
Thu Aug 26
Modified
Wed Oct 11
Author
Austin Songer
Path
rules/cloud/gcp/gworkspace/gcp_gworkspace_application_removed.yml
Raw Tags
attack.impact
View on GitHub