Analytics BIOC
Informational
✕
A Google Workspace Role privilege was deleted
A privilege was removed from a Google Workspace Role, This could potentially affect the access to services and data in the organization.
- Module:
- Identity Threat Detection (ITDR), SaaS Threat Detection
- Licensed by:
- Identity Threat Detection (ITDR)
- Data source:
- Google Workspace Audit Logs
ATT&CK tactics: Impact (TA0040)
ATT&CK techniques: Account Access Removal (T1531)
Detector tags: Google Workspace
Attacker's goals:
Gain access to sensitive data stored in the workspace. Gain elevated privileges in the workspace.
Investigative actions:
Investigate who was assigned the deleted role privilege. Verify if the role privilege was deleted intentionally.
- Test period:
- N/A (single event)
- Deduplication:
- 5 Days