Google Workspace Admin Audit: Application Removed from Domain

title: "Google Workspace Admin Audit: Application Removed from Domain"
id: 97bc9f2f-7927-4f21-8929-f7fb3589a771
status: test
description: This rule identifies Google Workspace administrative actions where an application is removed from the domain, including removal from an allowlist/whitelist. Attackers may use application removal or revocation events to disrupt legitimate access, reduce monitoring coverage, or manage which third-party apps can interact with the tenant. It relies on Google Workspace Admin audit logs from admin.googleapis.com, matching the specific event names for application removal.
references:
  - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3
  - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings?hl=en#REMOVE_APPLICATION
  - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings?hl=en#REMOVE_APPLICATION_FROM_WHITELIST
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/gworkspace/admin/gcp_gworkspace_application_removed.yml
author: Austin Songer, Huntrule Team
date: 2021-08-26
modified: 2023-10-11
tags:
  - attack.impact
logsource:
  product: gcp
  service: google_workspace.admin
detection:
  selection:
    eventService: admin.googleapis.com
    eventName:
      - REMOVE_APPLICATION
      - REMOVE_APPLICATION_FROM_WHITELIST
  condition: selection
falsepositives:
  - Application being removed may be performed by a System Administrator.
level: medium
license: DRL-1.1
related:
  - id: ee2803f0-71c8-4831-b48b-a1fc57601ee4
    type: derived