Google Workspace Suspended User Account Renewed

 1[metadata]
 2creation_date = "2020/11/17"
 3integration = ["google_workspace"]
 4maturity = "production"
 5min_stack_comments = "Breaking changes for Google Workspace integration."
 6min_stack_version = "8.4.0"
 7updated_date = "2023/06/22"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Detects when a previously suspended user's account is renewed in Google Workspace. An adversary may renew a suspended
13user account to maintain access to the Google Workspace organization with a valid account.
14"""
15false_positives = [
16    """
17    Google Workspace administrators may renew a suspended user account if the user is expected to continue employment at
18    the organization after temporary leave. Suspended user accounts are typically used by administrators to remove
19    access to the user while actions is taken to transfer important documents and roles to other users, prior to
20    deleting the user account and removing the license.
21    """,
22]
23from = "now-130m"
24index = ["filebeat-*", "logs-google_workspace*"]
25interval = "10m"
26language = "kuery"
27license = "Elastic License v2"
28name = "Google Workspace Suspended User Account Renewed"
29note = """## Setup
30
31The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
32
33### Important Information Regarding Google Workspace Event Lag Times
34- As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
35- This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
36- To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
37- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m).
38- See the following references for further information:
39  - https://support.google.com/a/answer/7061566
40  - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html"""
41references = ["https://support.google.com/a/answer/1110339"]
42risk_score = 21
43rule_id = "00678712-b2df-11ed-afe9-f661ea17fbcc"
44severity = "low"
45tags = ["Domain: Cloud", "Data Source: Google Workspace", "Use Case: Identity and Access Audit", "Tactic: Initial Access"]
46timestamp_override = "event.ingested"
47type = "query"
48
49query = '''
50event.dataset:google_workspace.admin and event.category:iam and event.action:UNSUSPEND_USER
51'''
52
53
54[[rule.threat]]
55framework = "MITRE ATT&CK"
56[[rule.threat.technique]]
57id = "T1078"
58name = "Valid Accounts"
59reference = "https://attack.mitre.org/techniques/T1078/"
60[[rule.threat.technique.subtechnique]]
61id = "T1078.004"
62name = "Cloud Accounts"
63reference = "https://attack.mitre.org/techniques/T1078/004/"
64
65
66
67[rule.threat.tactic]
68id = "TA0001"
69name = "Initial Access"
70reference = "https://attack.mitre.org/tactics/TA0001/"