Google Workspace Admin API: MFA Enforcement Relaxed by Setting to False

title: "Google Workspace Admin API: MFA Enforcement Relaxed by Setting to False"
id: ab0c830e-575d-47c6-95db-cee3ffde37a8
status: test
description: This rule flags Google Workspace admin events where the strong authentication (MFA enforcement) setting is changed so the new value is false. Disabling or relaxing MFA increases the likelihood of account compromise by reducing protection against password-based attacks. It relies on Google Workspace Admin activity audit events from admin.googleapis.com, matching the specific event names for enforcing or allowing strong authentication and the new setting value.
references:
  - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3
  - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-security-settings#ENFORCE_STRONG_AUTHENTICATION
  - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-security-settings?hl=en#ALLOW_STRONG_AUTHENTICATION
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/gworkspace/admin/gcp_gworkspace_mfa_disabled.yml
author: Austin Songer, Huntrule Team
date: 2021-08-26
modified: 2023-10-11
tags:
  - attack.impact
logsource:
  product: gcp
  service: google_workspace.admin
detection:
  selection_base:
    eventService: admin.googleapis.com
    eventName:
      - ENFORCE_STRONG_AUTHENTICATION
      - ALLOW_STRONG_AUTHENTICATION
  selection_eventValue:
    new_value: "false"
  condition: all of selection*
falsepositives:
  - MFA may be disabled and performed by a system administrator.
level: medium
license: DRL-1.1
related:
  - id: 780601d1-6376-4f2a-884e-b8d45599f78c
    type: derived