LoFP / google workspace admin roles may be deleted by system administrators. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.

Techniques

• T1484
• T1531

Sample rules

Google Workspace Admin Role Deletion

• source: elastic
• technicques:
  • T1484
  • T1531

Description

Detects when a custom administrative role is deleted in Google Workspace. Adversaries may delete a custom admin role to disrupt delegated administration, remove security team access, or hinder incident response. Deleting a role removes the privileges it granted from all assigned users and groups, which can cause operational impact or blind spots during an active investigation.

Detection logic

data_stream.dataset:google_workspace.admin and event.action:DELETE_ROLE