Google Workspace Admin: Application Removed from Domain
Flags Google Workspace domain events indicating an application was removed, including allowlist/whitelist removal.
FreeReviewedSigma · Medium · v4
- Product
- gcp
- Service
- google_workspace.admin
- Author
- Austin Songer (SigmaHQ), DRL 1.1
- Published
- 2021-08-26
- Updated
- 2026-07-31
What it detects
This rule identifies Google Workspace administrative audit events where an application is removed from the domain configuration, including removal from the allowlist. Attackers may remove applications to disrupt approved access paths, conceal changes to installed integrations, or prepare for follow-on misuse. Detection relies on Google Workspace admin audit logs reporting the admin.googleapis.com eventName values for application removal actions.
Reporting behind it
- cloud.google.comhttps://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3
- developers.google.comhttps://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings?hl=en#REMOVE_APPLICATION
- developers.google.comhttps://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings?hl=en#REMOVE_APPLICATION_FROM_WHITELIST
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/gworkspace/admin/gcp_gworkspace_application_removed.yml
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
google-workspace-admin-audit-application-removed-from-domain-ee2803f0
title: "Google Workspace Admin: Application Removed from Domain"
id: 97bc9f2f-7927-4f21-8929-f7fb3589a771
status: test
description: This rule identifies Google Workspace administrative audit events where an application is removed from the domain configuration, including removal from the allowlist. Attackers may remove applications to disrupt approved access paths, conceal changes to installed integrations, or prepare for follow-on misuse. Detection relies on Google Workspace admin audit logs reporting the admin.googleapis.com eventName values for application removal actions.
references:
- https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3
- https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings?hl=en#REMOVE_APPLICATION
- https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings?hl=en#REMOVE_APPLICATION_FROM_WHITELIST
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/gworkspace/admin/gcp_gworkspace_application_removed.yml
author: Austin Songer, Huntrule Team
date: 2021-08-26
modified: 2023-10-11
tags:
- attack.impact
logsource:
product: gcp
service: google_workspace.admin
detection:
selection:
eventService: admin.googleapis.com
eventName:
- REMOVE_APPLICATION
- REMOVE_APPLICATION_FROM_WHITELIST
condition: selection
falsepositives:
- Application being removed may be performed by a System Administrator.
level: medium
license: DRL-1.1
related:
- id: ee2803f0-71c8-4831-b48b-a1fc57601ee4
type: derived