LoFP / custom google workspace admin roles may be created by system administrators. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.

Techniques

• T1098

Sample rules

Google Workspace Custom Admin Role Created

• source: elastic
• technicques:
  • T1098

Description

Detects when a custom administrative role is created in Google Workspace. Unlike prebuilt admin roles, custom roles allow granular selection of privileges across Google services and can be assigned to users or groups. Adversaries may create a custom admin role to craft elevated permissions tailored to their objectives, then assign that role to a compromised or attacker-controlled account to establish persistence and enable follow-on actions such as modifying security controls, granting OAuth access, or changing mail routing.

Detection logic

data_stream.dataset:google_workspace.admin and event.action:CREATE_ROLE