Google Workspace Password Policy Changed

Severity: low
Type: Alert
Time window: 1h
Match by: email
Author: Google Cloud Security
Source: github.com/chronicle/detection-rules

Identifies when Google Workspace password policy is changed. Security teams can monitor for changes to password policy configuration that may weaken the organization's security posture.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1098` Account Manipulation

Telemetry coverage

Platform	Record / event type
Google Workspace	CHANGE_APPLICATION_SETTING: Application Setting Change
Google Workspace	CREATE_APPLICATION_SETTING: Application Setting Creation

Rules detecting the same action

These rules filter on the same operation.

Application Removed from Blocklist in Google Workspace (Elastic)
Google Workspace Bitlocker Setting Disabled (Elastic)
Google Workspace Gmail Routing or Forwarding Rule Created or Modified (Elastic)
Google Workspace Marketplace Allowlist Configuration (YARA-L)
Google Workspace Password Policy Modified (Elastic)
Google Workspace Restrictions for Marketplace Modified to Allow Any App (Elastic)
GSuite Workspace Gmail Pre-Delivery Message Scanning Disabled (Panther)
GSuite Workspace Gmail Security Sandbox Disabled (Panther)

Rule body

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule google_workspace_password_policy_changed {

  meta:
    author = "Google Cloud Security"
    description = "Identifies when Google Workspace password policy is changed. Security teams can monitor for changes to password policy configuration that may weaken the organization's security posture."
    rule_id = "mr_fd63a810-800a-4c55-97d2-080fc8a0e567"
    rule_name = "Google Workspace Password Policy Changed"
    mitre_attack_tactic = "Persistence"
    mitre_attack_technique = "Account Manipulation"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1098/"
    mitre_attack_version = "v13.1"
    type = "Alert"
    data_source = "Workspace Activity"
    severity = "Low"
    priority = "Low"

  events:
    $ws.metadata.vendor_name = "Google Workspace"
    $ws.metadata.product_name = "admin"
    ($ws.metadata.product_event_type = "CREATE_APPLICATION_SETTING" or
    $ws.metadata.product_event_type = "CHANGE_APPLICATION_SETTING")
    $ws.security_result.category_details = "APPLICATION_SETTINGS"
    $ws.target.resource.name = /Password Management/
    $ws.principal.user.email_addresses = $email

  match:
    $email over 1h

  outcome:
    $risk_score = max(35)
    $mitre_attack_tactic = "Persistence"
    $mitre_attack_technique = "Account Manipulation"
    $mitre_attack_technique_id = "T1098"
    $event_count = count_distinct($ws.metadata.id)
    $principal_ip = array_distinct($ws.principal.ip)
    $principal_country = array_distinct($ws.principal.ip_geo_artifact.location.country_or_region)
    $principal_state = array_distinct($ws.principal.ip_geo_artifact.location.state)
    $principal_user_emails = array_distinct($ws.principal.user.email_addresses)
    $principal_user_id = array_distinct($ws.principal.user.userid)
    $target_application =array_distinct($ws.target.application)
    $password_policies =array_distinct($ws.target.resource.name)

  condition:
    $ws
}

YARA-L rule structure

Condition

Fires when at least one $ws event in the 1h window.

Events

`$ws`

metadata.product_event_type is one of:
- CREATE_APPLICATION_SETTING
- CHANGE_APPLICATION_SETTING
security_result.category_details = "APPLICATION_SETTINGS"
target.resource.name matches "Password Management"

Match and correlation

Match key: $email (principal.user.email_addresses)
Within: 1h

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

Field	Expression
`risk_score`	`max(35)`
`event_count`	`count_distinct($ws.metadata.id)`
`principal_ip`	`array_distinct($ws.principal.ip)`
`principal_country`	`array_distinct($ws.principal.ip_geo_artifact.location.country_or_region)`
`principal_state`	`array_distinct($ws.principal.ip_geo_artifact.location.state)`
`principal_user_emails`	`array_distinct($ws.principal.user.email_addresses)`
`principal_user_id`	`array_distinct($ws.principal.user.userid)`
`target_application`	`array_distinct($ws.target.application)`
`password_policies`	`array_distinct($ws.target.resource.name)`