admin | Detection.FYI

Google Workspace Application Access Level Modified

Apr 28, 2026 · attack.persistence attack.privilege-escalation attack.t1098.003 ·
Share on:

Detects when an access level is changed for a Google workspace application. An access level is part of BeyondCorp Enterprise which is Google Workspace's way of enforcing Zero Trust model. An adversary would be able to remove access levels to gain easier access to Google workspace resources.

Read More
Google Workspace Application Removed

Apr 28, 2026 · attack.impact ·
Share on:

Detects when an an application is removed from Google Workspace.

Read More
Google Workspace Granted Domain API Access

Apr 28, 2026 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Detects when an API access service account is granted domain authority.

Read More
Google Workspace MFA Disabled

Apr 28, 2026 · attack.impact ·
Share on:

Detects when multi-factor authentication (MFA) is disabled.

Read More
Google Workspace Role Modified or Deleted

Apr 28, 2026 · attack.impact ·
Share on:

Detects when an a role is modified or deleted in Google Workspace.

Read More
Google Workspace Role Privilege Deleted

Apr 28, 2026 · attack.impact ·
Share on:

Detects when an a role privilege is deleted in Google Workspace.

Read More
Google Workspace User Granted Admin Privileges

Apr 28, 2026 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Detects when an Google Workspace user is granted admin privileges.

Read More