Analytics BIOC
Informational
✕
Admin privileges were granted to a Google Workspace user
Admin privileges were granted to a Google Workspace user. This user now has access to additional administrative functions and settings.
- Module:
- Identity Threat Detection (ITDR), SaaS Threat Detection
- Licensed by:
- Identity Threat Detection (ITDR)
- Data source:
- Google Workspace Audit Logs
ATT&CK tactics: Privilege Escalation (TA0004)
ATT&CK techniques: Valid Accounts (T1078)
Detector tags: Google Workspace
Attacker's goals:
Gain access to sensitive data stored in Google Workspace. Manipulate or delete data stored in Google Workspace. Gain access to privileged features in Google Workspace.
Investigative actions:
Check which Google Workspace user was granted the admin privileges. Check if the user is authorized to be granted such privileges. Review the audit logs to determine the actions taken by the user.
- Test period:
- N/A (single event)
- Deduplication:
- 5 Days