GCP Admin SDK: Google Workspace Application Access Level Changed via ContextAwareAccess

Alerts on Google Workspace application setting changes affecting ContextAwareAccess access levels.

FreeUnreviewedSigmamediumv1

gcp-admin-sdk-google-workspace-application-access-level-changed-via-contextaware-22f2fb54

title: "GCP Admin SDK: Google Workspace Application Access Level Changed via ContextAwareAccess"
id: 592963d3-e5fb-4f8a-b74c-35eb0cbd1576
status: test
description: This rule flags Google Workspace administrator activity where an application setting is changed through the Admin SDK, specifically when the changed setting name starts with ContextAwareAccess. Altering these access levels can reduce enforced access restrictions, potentially enabling easier access to Google Workspace resources. It relies on event telemetry from admin.googleapis.com capturing CHANGE_APPLICATION_SETTING events and the setting_name value.
references:
  - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-application-settings
  - https://support.google.com/a/answer/9261439
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/gworkspace/admin/gcp_gworkspace_application_access_levels_modified.yml
author: Bryan Lim, Huntrule Team
date: 2024-01-12
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1098.003
logsource:
  product: gcp
  service: google_workspace.admin
detection:
  selection:
    eventService: admin.googleapis.com
    eventName: CHANGE_APPLICATION_SETTING
    setting_name|startswith: ContextAwareAccess
  condition: selection
falsepositives:
  - Legitimate administrative activities changing the access levels for an application
level: medium
license: DRL-1.1
related:
  - id: 22f2fb54-5312-435d-852f-7c74f81684ca
    type: derived

What it detects

This rule flags Google Workspace administrator activity where an application setting is changed through the Admin SDK, specifically when the changed setting name starts with ContextAwareAccess. Altering these access levels can reduce enforced access restrictions, potentially enabling easier access to Google Workspace resources. It relies on event telemetry from admin.googleapis.com capturing CHANGE_APPLICATION_SETTING events and the setting_name value.

Known false positives

Legitimate administrative activities changing the access levels for an application

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.