huntrule

Google Workspace Admin: Application Removed from Domain

Flags Google Workspace domain events indicating an application was removed, including allowlist/whitelist removal.

FreeReviewedSigma · Medium · v4
Product
gcp
Service
google_workspace.admin
Author
Austin Songer (SigmaHQ), DRL 1.1
Published
2021-08-26
Updated
2026-07-31
AnalysisDetection
title: "Google Workspace Admin: Application Removed from Domain"
id: 97bc9f2f-7927-4f21-8929-f7fb3589a771
status: test
description: This rule identifies Google Workspace administrative audit events where an application is removed from the domain configuration, including removal from the allowlist. Attackers may remove applications to disrupt approved access paths, conceal changes to installed integrations, or prepare for follow-on misuse. Detection relies on Google Workspace admin audit logs reporting the admin.googleapis.com eventName values for application removal actions.
references:
  - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3
  - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings?hl=en#REMOVE_APPLICATION
  - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings?hl=en#REMOVE_APPLICATION_FROM_WHITELIST
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/gworkspace/admin/gcp_gworkspace_application_removed.yml
author: Austin Songer, Huntrule Team
date: 2021-08-26
modified: 2023-10-11
tags:
  - attack.impact
logsource:
  product: gcp
  service: google_workspace.admin
detection:
  selection:
    eventService: admin.googleapis.com
    eventName:
      - REMOVE_APPLICATION
      - REMOVE_APPLICATION_FROM_WHITELIST
  condition: selection
falsepositives:
  - Application being removed may be performed by a System Administrator.
level: medium
license: DRL-1.1
related:
  - id: ee2803f0-71c8-4831-b48b-a1fc57601ee4
    type: derived