Google Workspace Admin Role Modified or Deleted via admin.googleapis.com Audit Events
Identifies Google Workspace role updates, renames, or deletions from admin.googleapis.com audit events.
FreeReviewedSigma · Medium · v4
- Product
- gcp
- Service
- google_workspace.admin
- Author
- Austin Songer (SigmaHQ), DRL 1.1
- Published
- 2021-08-24
- Updated
- 2026-07-31
What it detects
This rule identifies changes to Google Workspace admin roles where the role is deleted, renamed, or updated. Attackers may abuse role modifications to escalate or maintain access while reducing visibility by altering or removing permissions. It relies on audit log events from admin.googleapis.com, matching specific event names for role updates (DELETE_ROLE, RENAME_ROLE, UPDATE_ROLE).
Reporting behind it
- cloud.google.comhttps://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3
- developers.google.comhttps://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-delegated-admin-settings
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/gworkspace/admin/gcp_gworkspace_role_modified_or_deleted.yml
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
google-workspace-admin-role-modified-or-deleted-via-admin-api-audit-events-6aef64e3
title: Google Workspace Admin Role Modified or Deleted via admin.googleapis.com Audit Events
id: 08b9b529-8228-47f1-b391-70015600be7d
status: test
description: This rule identifies changes to Google Workspace admin roles where the role is deleted, renamed, or updated. Attackers may abuse role modifications to escalate or maintain access while reducing visibility by altering or removing permissions. It relies on audit log events from admin.googleapis.com, matching specific event names for role updates (DELETE_ROLE, RENAME_ROLE, UPDATE_ROLE).
references:
- https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3
- https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-delegated-admin-settings
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/gworkspace/admin/gcp_gworkspace_role_modified_or_deleted.yml
author: Austin Songer, Huntrule Team
date: 2021-08-24
modified: 2023-10-11
tags:
- attack.impact
logsource:
product: gcp
service: google_workspace.admin
detection:
selection:
eventService: admin.googleapis.com
eventName:
- DELETE_ROLE
- RENAME_ROLE
- UPDATE_ROLE
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 6aef64e3-60c6-4782-8db3-8448759c714e
type: derived