LoFP LoFP / google workspace admin role assignments may be modified by system administrators. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.

Techniques

Sample rules

Google Workspace Admin Role Assigned to a User or Group

Description

Assigning an administrative role to a user or group grants elevated privileges within Google Workspace, including access to the Google Admin console and the ability to manage domain resources and applications. Adversaries may assign administrator roles to an existing account or a newly created account/group to establish persistence, facilitate privilege escalation, and enable follow-on actions across the tenant. In particular, users with Super Admin privileges can bypass single sign-on (SSO) if it is enabled in Google Workspace.

Detection logic

data_stream.dataset:"google_workspace.admin" and event.action:"ASSIGN_ROLE"
  and google_workspace.admin.role.name : *_ADMIN_ROLE