Google Workspace Admin Role Modified or Deleted via Admin API Audit Events

title: Google Workspace Admin Role Modified or Deleted via Admin API Audit Events
id: 08b9b529-8228-47f1-b391-70015600be7d
status: test
description: This rule flags Google Workspace administrative changes to roles when a role is updated, renamed, or deleted. Attackers may use role modifications or removals to alter access pathways, reduce oversight, or maintain persistence by changing effective permissions. It relies on audit events from the admin.googleapis.com service with event names DELETE_ROLE, RENAME_ROLE, and UPDATE_ROLE.
references:
  - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3
  - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-delegated-admin-settings
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/gworkspace/admin/gcp_gworkspace_role_modified_or_deleted.yml
author: Austin Songer, Huntrule Team
date: 2021-08-24
modified: 2023-10-11
tags:
  - attack.impact
logsource:
  product: gcp
  service: google_workspace.admin
detection:
  selection:
    eventService: admin.googleapis.com
    eventName:
      - DELETE_ROLE
      - RENAME_ROLE
      - UPDATE_ROLE
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 6aef64e3-60c6-4782-8db3-8448759c714e
    type: derived