Google Workspace organizational unit was modified

Analytics BIOC Informational

Google Workspace organizational unit was modified

A Google Workspace admin modified an organizational unit.

Module:: Identity Threat Detection (ITDR), SaaS Threat Detection
Licensed by:: Identity Threat Detection (ITDR)
Data source:: Google Workspace Audit Logs

ATT&CK tactics: Persistence (TA0003)

ATT&CK techniques: Account Manipulation (T1098)

Detector tags: Google Workspace

Attacker's goals:

Adversaries may change the organizational unit the user belongs to, so they could inherit permissions for applications and resources that were inaccessible before.

Investigative actions:

Check if the identity intended to perform this action or look for signs that the user account is compromised (e.g. abnormal logins, unusual activity). Follow further actions done by the account.

Test period:: N/A (single event)
Deduplication:: 5 Days