Google Workspace Suspended User Account Renewed

 1[metadata]
 2creation_date = "2020/11/17"
 3integration = ["google_workspace"]
 4maturity = "production"
 5updated_date = "2024/09/23"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Detects when a previously suspended user's account is renewed in Google Workspace. An adversary may renew a suspended
11user account to maintain access to the Google Workspace organization with a valid account.
12"""
13false_positives = [
14    """
15    Google Workspace administrators may renew a suspended user account if the user is expected to continue employment at
16    the organization after temporary leave. Suspended user accounts are typically used by administrators to remove
17    access to the user while actions is taken to transfer important documents and roles to other users, prior to
18    deleting the user account and removing the license.
19    """,
20]
21from = "now-130m"
22index = ["filebeat-*", "logs-google_workspace*"]
23interval = "10m"
24language = "kuery"
25license = "Elastic License v2"
26name = "Google Workspace Suspended User Account Renewed"
27note = """## Setup
28
29The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
30
31### Important Information Regarding Google Workspace Event Lag Times
32- As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
33- This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
34- To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
35- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m).
36- See the following references for further information:
37  - https://support.google.com/a/answer/7061566
38  - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html"""
39references = [
40    "https://support.google.com/a/answer/1110339",
41    "https://www.elastic.co/security-labs/google-workspace-attack-surface-part-one",
42    "https://www.elastic.co/security-labs/google-workspace-attack-surface-part-two"
43]
44risk_score = 21
45rule_id = "00678712-b2df-11ed-afe9-f661ea17fbcc"
46severity = "low"
47tags = [
48    "Domain: Cloud",
49    "Data Source: Google Workspace",
50    "Use Case: Identity and Access Audit",
51    "Tactic: Initial Access",
52]
53timestamp_override = "event.ingested"
54type = "query"
55
56query = '''
57event.dataset:google_workspace.admin and event.category:iam and event.action:UNSUSPEND_USER
58'''
59
60
61[[rule.threat]]
62framework = "MITRE ATT&CK"
63[[rule.threat.technique]]
64id = "T1078"
65name = "Valid Accounts"
66reference = "https://attack.mitre.org/techniques/T1078/"
67[[rule.threat.technique.subtechnique]]
68id = "T1078.004"
69name = "Cloud Accounts"
70reference = "https://attack.mitre.org/techniques/T1078/004/"
71
72
73
74[rule.threat.tactic]
75id = "TA0001"
76name = "Initial Access"
77reference = "https://attack.mitre.org/tactics/TA0001/"