Suspicious Change of Google Workspace Application Access Level (via google_workspace.admin)

title: Suspicious Change of Google Workspace Application Access Level (via google_workspace.admin)
id: feb927c5-2692-5fa4-bf17-9e51688d617a
status: stable
description: This rule detects when an access level is changed for a Google workspace application. An access level is part of BeyondCorp Enterprise which is Google Workspace's way of enforcing Zero Trust model. An adversary would be able to remove access levels to gain easier access to Google workspace resources.
references:
    - https://attack.mitre.org/techniques/T1098/003/
    - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-application-settings
    - https://support.google.com/a/answer/9261439
author: Huntrule Team
date: 2026-01-24
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1098.003
logsource:
    product: gcp
    service: google_workspace.admin
detection:
    selection:
        eventService: 'admin.googleapis.com'
        eventName: 'CHANGE_APPLICATION_SETTING'
        setting_name|startswith: 'ContextAwareAccess'
    condition: selection
falsepositives:
    - Unknown
level: medium