Google Workspace Admin: Detect Role Privilege Deletion (REMOVE_PRIVILEGE)
Triggers on Google Workspace role privilege removal events (REMOVE_PRIVILEGE) in Admin audit logs.
FreeReviewedSigma · Medium · v4
- Product
- gcp
- Service
- google_workspace.admin
- Author
- Austin Songer (SigmaHQ), DRL 1.1
- Published
- 2021-08-24
- Updated
- 2026-07-31
What it detects
This rule flags Google Workspace role privilege deletions when the admin activity reports a REMOVE_PRIVILEGE event from admin.googleapis.com. Deleting a role privilege can be used to reduce or alter access controls, either as part of routine admin maintenance or to impact an environment’s permissions. The detection relies on Google Workspace Admin audit log telemetry capturing the specific eventService and eventName values for the removal action.
Reporting behind it
- cloud.google.comhttps://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3
- developers.google.comhttps://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-delegated-admin-settings
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/gworkspace/admin/gcp_gworkspace_role_privilege_deleted.yml
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
google-workspace-admin-role-privilege-removed-via-remove-privilege-bf638ef7
title: "Google Workspace Admin: Detect Role Privilege Deletion (REMOVE_PRIVILEGE)"
id: 47e3efef-1e0e-40ef-9606-945ae6c83f67
status: test
description: This rule flags Google Workspace role privilege deletions when the admin activity reports a REMOVE_PRIVILEGE event from admin.googleapis.com. Deleting a role privilege can be used to reduce or alter access controls, either as part of routine admin maintenance or to impact an environment’s permissions. The detection relies on Google Workspace Admin audit log telemetry capturing the specific eventService and eventName values for the removal action.
references:
- https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3
- https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-delegated-admin-settings
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/gworkspace/admin/gcp_gworkspace_role_privilege_deleted.yml
author: Austin Songer, Huntrule Team
date: 2021-08-24
modified: 2023-10-11
tags:
- attack.impact
logsource:
product: gcp
service: google_workspace.admin
detection:
selection:
eventService: admin.googleapis.com
eventName: REMOVE_PRIVILEGE
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: bf638ef7-4d2d-44bb-a1dc-a238252e6267
type: derived