Analytics BIOC
Informational
✕
A Google Workspace user was removed from a group
A user removed another user from a Google Workspace group.
- Module:
- Identity Threat Detection (ITDR), SaaS Threat Detection
- Licensed by:
- Identity Threat Detection (ITDR)
- Data source:
- Google Workspace Audit Logs
ATT&CK tactics: Impact (TA0040)
ATT&CK techniques: Account Access Removal (T1531)
Detector tags: Google Workspace
Attacker's goals:
Adversaries may interrupt the availability of services and resources by inhibiting access to users.
Investigative actions:
Check if the identity intended to perform this action or look for signs that the user account is compromised (e.g. abnormal logins, unusual activity). Check if the user's work can be affected by this action. Follow further actions done by the account.
- Test period:
- N/A (single event)
- Deduplication:
- 5 Days