User Accounts

eventName	Description	Sample	Rule
any	Source-only rules that filter on applicationName 'user_accounts' without specifying an eventName attribute here.	N	N
2sv_disable	A user disabled 2-Step Verification on their account (user self-service action).	N	Y
2sv_enroll	A user enrolled in 2-Step Verification (user self-service action).	Y	N
password_edit	A user changed their own account password.	Y	N
recovery_email_edit	A user changed their account recovery email address.	N	N
recovery_phone_edit	A user changed their account recovery phone number.	N	N
email_forwarding_out_of_domain	A user configured automatic email forwarding to an external address.	Y	Y
titanium_enroll	A user enrolled in Google's Advanced Protection Program.	N	N
titanium_unenroll	A user left Google's Advanced Protection Program.	N	Y

any: User Accounts (any event)

ApplicationName: user_accounts

Description

Source-only rules that filter on applicationName 'user_accounts' without specifying an eventName attribute here.

References #

Reports API: user_accounts activity events

2sv_disable: 2-Step Verification Disabled

ApplicationName: user_accounts

Description

A user disabled 2-Step Verification on their account (user self-service action).

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Google Workspace 2SV Policy Disabled By User source high: Detects when a Google Workspace user disables 2-step verification (2SV) on their account. An adversary with access to a compromised account may remove 2SV to eliminate the second authentication factor, leaving password-only access and making future sign-ins easier to abuse, relay, or maintain without triggering MFA challenges.T1556

Panther #

GSuite User Two Step Verification Change source low: A user disabled two step verification for themselves.T1556

References #

User Accounts Activity Events

2sv_enroll: 2-Step Verification Enrolled

ApplicationName: user_accounts

Description

A user enrolled in 2-Step Verification (user self-service action).

Example Audit Activity #

{
  "kind": "admin#reports#activity",
  "id": {
    "time": "2022-08-02T07:08:03.018Z",
    "uniqueQualifier": "8958327431473786420",
    "applicationName": "user_accounts",
    "customerId": "C00mpaiwz"
  },
  "etag": "\"_ZVRqe-BUDYcYeOIPo-gm6Eh1QaGne4ACjHHI6qsr6A/A59hRE9Oahn4bdGbzJBSjfYeZfc\"",
  "actor": {
    "callerType": "USER",
    "email": "workspace@cloud-response.com",
    "profileId": "102509620547980436027"
  },
  "ipAddress": "31.171.152.13",
  "events": [
    {
      "type": "2sv_change",
      "name": "2sv_enroll"
    }
  ]
}

References #

password_edit: Password Edit

ApplicationName: user_accounts

Description

A user changed their own account password.

Example Audit Activity #

{
  "kind": "admin#reports#activity",
  "id": {
    "time": "2022-07-21T13:40:49.268Z",
    "uniqueQualifier": "-6977913962455696939",
    "applicationName": "user_accounts",
    "customerId": "C00mpaiwz"
  },
  "etag": "\"_ZVRqe-BUDYcYeOIPo-gm6Eh1QaGne4ACjHHI6qsr6A/KNpRbIeqKJRteuQ7gcPLjNg67qA\"",
  "actor": {
    "callerType": "USER",
    "email": "suspicious@cloud-response.com",
    "profileId": "102509620547980436027"
  },
  "ipAddress": "80.114.222.200",
  "events": [
    {
      "type": "password_change",
      "name": "password_edit"
    }
  ]
}

References #

recovery_email_edit: Recovery Email Edit

ApplicationName: user_accounts

Description

A user changed their account recovery email address.

References #

User Accounts Activity Events

recovery_phone_edit: Recovery Phone Edit

ApplicationName: user_accounts

Description

A user changed their account recovery phone number.

References #

User Accounts Activity Events

email_forwarding_out_of_domain: Email Forwarding Out of Domain

ApplicationName: user_accounts

Description

A user configured automatic email forwarding to an external address.

Example Audit Activity #

{
  "kind": "admin#reports#activity",
  "id": {
    "time": "2022-08-02T07:09:00.429Z",
    "uniqueQualifier": "-6303014327256218067",
    "applicationName": "user_accounts",
    "customerId": "C00mpaiwz"
  },
  "etag": "\"_ZVRqe-BUDYcYeOIPo-gm6Eh1QaGne4ACjHHI6qsr6A/gyx-nOcYjq3Rj2fWq5GYhiZBsL0\"",
  "actor": {
    "callerType": "USER",
    "email": "workspace@cloud-response.com",
    "profileId": "102509620547980436027"
  },
  "ipAddress": "31.171.152.13",
  "events": [
    {
      "type": "email_forwarding_change",
      "name": "email_forwarding_out_of_domain",
      "parameters": [
        {
          "name": "email_forwarding_destination_address",
          "value": "korstiaanstam@gmail.com"
        }
      ]
    }
  ]
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Google Workspace Out Of Domain Email Forwarding source medium: Detects automatic email forwarding to external domains in Google Workspace, which may indicate data leakage or misuse.T1114, T1114.003

Panther #

Gsuite Mail forwarded to external domain source medium: A user has configured mail forwarding to an external domainT1114

References #

titanium_enroll: Advanced Protection Enrolled

ApplicationName: user_accounts

Description

A user enrolled in Google's Advanced Protection Program.

References #

User Accounts Activity Events

titanium_unenroll: Advanced Protection Unenrolled

ApplicationName: user_accounts

Description

A user left Google's Advanced Protection Program.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

GSuite User Advanced Protection Change source low: A user disabled advanced protection for themselves.T1562

References #

User Accounts Activity Events