GCP Google Workspace Admin Role Granted to User

title: GCP Google Workspace Admin Role Granted to User
id: af856ae5-bd3b-45fa-bb68-7d7d13436811
status: test
description: This rule identifies events where a Google Workspace user is granted delegated admin privileges or standard admin privileges. Granting admin access enables attackers to persist and expand control over tenant configurations and user management capabilities. It relies on Google Workspace admin audit events from admin.googleapis.com with event names indicating admin privilege grants.
references:
  - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3
  - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-user-settings#GRANT_ADMIN_PRIVILEGE
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/gworkspace/admin/gcp_gworkspace_user_granted_admin_privileges.yml
author: Austin Songer, Huntrule Team
date: 2021-08-23
modified: 2023-10-11
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1098
logsource:
  product: gcp
  service: google_workspace.admin
detection:
  selection:
    eventService: admin.googleapis.com
    eventName:
      - GRANT_DELEGATED_ADMIN_PRIVILEGES
      - GRANT_ADMIN_PRIVILEGE
  condition: selection
falsepositives:
  - Google Workspace admin role privileges, may be modified by system administrators.
level: medium
license: DRL-1.1
related:
  - id: 2d1b83e4-17c6-4896-a37b-29140b40a788
    type: derived