Security object deletion in Google Workspace Admin Console

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Google Workspace Audit Logs
Detection Modules	Identity Threat Module, SaaS Threat Detection
Detector Tags	Google Workspace
ATT&CK Tactic	Defense Impairment (TA0112)
ATT&CK Technique	Disable or Modify Tools (T1685)
Severity	Informational

Description

A security object was deleted in Google Workspace Admin Console.

Attacker's Goals

Adversaries may modify or disable security rules to avoid detection of their activities.

Investigative actions

• Investigate the security object name deleted and whether it was intended.
• Check if the user was recently granted new elevated permissions that allowed them to delete security rules.
• Follow other administrative or suspicious actions performed by this user around the same time.

Variations

Security object deletion in Google Workspace Admin Console for the first time

Synopsis

Field	Value
ATT&CK Tactic	Defense Impairment (TA0112)
ATT&CK Technique	Disable or Modify Tools (T1685)
Severity	Low

Description

A security object was deleted in Google Workspace Admin Console.

Attacker's Goals

Adversaries may modify or disable security rules to avoid detection of their activities.

Investigative actions

• Investigate the security object name deleted and whether it was intended.
• Check if the user was recently granted new elevated permissions that allowed them to delete security rules.
• Follow other administrative or suspicious actions performed by this user around the same time.