Google Workspace Application Access Level Modified

Status: test
Severity: medium
Log source: product gcp, service google_workspace.admin
Author: Bryan Lim
Source: github.com/SigmaHQ/sigma

Detects when an access level is changed for a Google workspace application. An access level is part of BeyondCorp Enterprise which is Google Workspace's way of enforcing Zero Trust model. An adversary would be able to remove access levels to gain easier access to Google workspace resources.

Known false positives

Legitimate administrative activities changing the access levels for an application

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1098.003` Account Manipulation: Additional Cloud Roles
Privilege Escalation	`T1098.003` Account Manipulation: Additional Cloud Roles

Telemetry coverage

Platform	Record / event type
Google Workspace	CHANGE_APPLICATION_SETTING: Application Setting Change

Rule body

title: Google Workspace Application Access Level Modified
id: 22f2fb54-5312-435d-852f-7c74f81684ca
status: test
description: |
    Detects when an access level is changed for a Google workspace application.
    An access level is part of BeyondCorp Enterprise which is Google Workspace's way of enforcing Zero Trust model.
    An adversary would be able to remove access levels to gain easier access to Google workspace resources.
references:
    - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-application-settings
    - https://support.google.com/a/answer/9261439
author: Bryan Lim
date: 2024-01-12
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1098.003
logsource:
    product: gcp
    service: google_workspace.admin
detection:
    selection:
        eventService: 'admin.googleapis.com'
        eventName: 'CHANGE_APPLICATION_SETTING'
        setting_name|startswith: 'ContextAwareAccess'
    condition: selection
falsepositives:
    - Legitimate administrative activities changing the access levels for an application
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    eventService: 'admin.googleapis.com'
    eventName: 'CHANGE_APPLICATION_SETTING'
    setting_name|startswith: 'ContextAwareAccess'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	eq	`CHANGE_APPLICATION_SETTING`	`field:"aws::eventName" kind:eq value:"CHANGE_APPLICATION_SETTING"`
`eventService`	eq	`admin.googleapis.com`	`field:"gcp::service_name" kind:eq value:"admin.googleapis.com"`
`setting_name`	starts_with	`ContextAwareAccess`	`field:"setting_name" kind:starts_with value:"ContextAwareAccess"`