Google Workspace User Granted Admin Privileges

Title: Google Workspace User Granted Admin Privileges
Status: test
Description:Detects when an Google Workspace user is granted admin privileges.
References:
  -https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3
  -https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-user-settings#GRANT_ADMIN_PRIVILEGE
Author: Austin Songer
Date: 2021-08-23
modified:2023-10-11
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.t1098'

Logsource:

• product: gcp
• service: google_workspace.admin

Detection:
  selection:
    eventService: 'admin.googleapis.com'
    eventName:
      -'GRANT_DELEGATED_ADMIN_PRIVILEGES'
      -'GRANT_ADMIN_PRIVILEGE'

  condition:selection
Falsepositives:
  -Google Workspace admin role privileges, may be modified by system administrators.
Level: medium