huntrule

Google Workspace Admin Role Modified or Deleted via admin.googleapis.com Audit Events

Identifies Google Workspace role updates, renames, or deletions from admin.googleapis.com audit events.

FreeReviewedSigma · Medium · v4
Product
gcp
Service
google_workspace.admin
Author
Austin Songer (SigmaHQ), DRL 1.1
Published
2021-08-24
Updated
2026-07-31
AnalysisDetection
title: Google Workspace Admin Role Modified or Deleted via admin.googleapis.com Audit Events
id: 08b9b529-8228-47f1-b391-70015600be7d
status: test
description: This rule identifies changes to Google Workspace admin roles where the role is deleted, renamed, or updated. Attackers may abuse role modifications to escalate or maintain access while reducing visibility by altering or removing permissions. It relies on audit log events from admin.googleapis.com, matching specific event names for role updates (DELETE_ROLE, RENAME_ROLE, UPDATE_ROLE).
references:
  - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3
  - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-delegated-admin-settings
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/gworkspace/admin/gcp_gworkspace_role_modified_or_deleted.yml
author: Austin Songer, Huntrule Team
date: 2021-08-24
modified: 2023-10-11
tags:
  - attack.impact
logsource:
  product: gcp
  service: google_workspace.admin
detection:
  selection:
    eventService: admin.googleapis.com
    eventName:
      - DELETE_ROLE
      - RENAME_ROLE
      - UPDATE_ROLE
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 6aef64e3-60c6-4782-8db3-8448759c714e
    type: derived