Analytics BIOC Informational

A Google Workspace Role privilege was deleted

A privilege was removed from a Google Workspace Role, This could potentially affect the access to services and data in the organization.

Module:
Identity Threat Detection (ITDR), SaaS Threat Detection
Licensed by:
Identity Threat Detection (ITDR)
Data source:
Google Workspace Audit Logs
ATT&CK tactics: Impact (TA0040)
ATT&CK techniques: Account Access Removal (T1531)
Detector tags: Google Workspace
Attacker's goals:

Gain access to sensitive data stored in the workspace. Gain elevated privileges in the workspace.

Investigative actions:

Investigate who was assigned the deleted role privilege. Verify if the role privilege was deleted intentionally.

Test period:
N/A (single event)
Deduplication:
5 Days