Elastic Security Detection Rules

Google Workspace User Organizational Unit Changed

Last updated 2 months ago on 2024-09-23
Created 2 years ago on 2022-09-06

About

Users in Google Workspace are typically assigned a specific organizational unit that grants them permissions to certain services and roles that are inherited from this organizational unit. Adversaries may compromise a valid account and change which organizational account the user belongs to which then could allow them to inherit permissions to applications and resources inaccessible prior to.
Tags
Domain: CloudData Source: Google WorkspaceUse Case: Configuration AuditTactic: Persistence
Severity
low
Risk Score
21
MITRE ATT&CK™

Persistence (TA0003)(opens in a new tab or window)

↳ Account Manipulation (T1098)(opens in a new tab or window)

False Positive Examples
Google Workspace administrators may adjust change which organizational unit a user belongs to as a result of internal role adjustments.
License
Elastic License v2(opens in a new tab or window)

Definition

Rule Type
Query (Kibana Query Language)
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
filebeat-*logs-google_workspace*
Related Integrations

google_workspace(opens in a new tab or window)

Query
event.dataset:"google_workspace.admin" and event.type:change and event.category:iam
    and google_workspace.event.type:"USER_SETTINGS" and event.action:"MOVE_USER_TO_ORG_UNIT"

Install detection rules in Elastic Security

Detect Google Workspace User Organizational Unit Changed in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(opens in a new tab or window).