Google Workspace organizational unit was modified

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	5 Days
Required Data	Google Workspace Audit Logs
Detection Modules	Identity Threat Module, SaaS Threat Detection
Detector Tags	Google Workspace
ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Account Manipulation (T1098)
Severity	Informational

Description

A Google Workspace admin modified an organizational unit.

Attacker's Goals

Adversaries may change the organizational unit the user belongs to, so they could inherit permissions for applications and resources that were inaccessible before.

Investigative actions

• Check if the identity intended to perform this action or look for signs that the user account is compromised (e.g. abnormal logins, unusual activity).
• Follow further actions done by the account.