admin on Detection.FYI https://detection.fyi/sigmahq/sigma/cloud/gcp/gworkspace/admin/ Recent content in admin on Detection.FYI Hugo -- gohugo.io Tue, 28 Apr 2026 00:48:14 +0000 Google Workspace Application Access Level Modified https://detection.fyi/sigmahq/sigma/cloud/gcp/gworkspace/admin/gcp_gworkspace_application_access_levels_modified/ Tue, 28 Apr 2026 00:48:14 +0000 https://detection.fyi/sigmahq/sigma/cloud/gcp/gworkspace/admin/gcp_gworkspace_application_access_levels_modified/ Detects when an access level is changed for a Google workspace application. An access level is part of BeyondCorp Enterprise which is Google Workspace's way of enforcing Zero Trust model. An adversary would be able to remove access levels to gain easier access to Google workspace resources. Google Workspace Application Removed https://detection.fyi/sigmahq/sigma/cloud/gcp/gworkspace/admin/gcp_gworkspace_application_removed/ Tue, 28 Apr 2026 00:48:14 +0000 https://detection.fyi/sigmahq/sigma/cloud/gcp/gworkspace/admin/gcp_gworkspace_application_removed/ Detects when an an application is removed from Google Workspace. Google Workspace Granted Domain API Access https://detection.fyi/sigmahq/sigma/cloud/gcp/gworkspace/admin/gcp_gworkspace_granted_domain_api_access/ Tue, 28 Apr 2026 00:48:14 +0000 https://detection.fyi/sigmahq/sigma/cloud/gcp/gworkspace/admin/gcp_gworkspace_granted_domain_api_access/ Detects when an API access service account is granted domain authority. Google Workspace MFA Disabled https://detection.fyi/sigmahq/sigma/cloud/gcp/gworkspace/admin/gcp_gworkspace_mfa_disabled/ Tue, 28 Apr 2026 00:48:14 +0000 https://detection.fyi/sigmahq/sigma/cloud/gcp/gworkspace/admin/gcp_gworkspace_mfa_disabled/ Detects when multi-factor authentication (MFA) is disabled. Google Workspace Role Modified or Deleted https://detection.fyi/sigmahq/sigma/cloud/gcp/gworkspace/admin/gcp_gworkspace_role_modified_or_deleted/ Tue, 28 Apr 2026 00:48:14 +0000 https://detection.fyi/sigmahq/sigma/cloud/gcp/gworkspace/admin/gcp_gworkspace_role_modified_or_deleted/ Detects when an a role is modified or deleted in Google Workspace. Google Workspace Role Privilege Deleted https://detection.fyi/sigmahq/sigma/cloud/gcp/gworkspace/admin/gcp_gworkspace_role_privilege_deleted/ Tue, 28 Apr 2026 00:48:14 +0000 https://detection.fyi/sigmahq/sigma/cloud/gcp/gworkspace/admin/gcp_gworkspace_role_privilege_deleted/ Detects when an a role privilege is deleted in Google Workspace. Google Workspace User Granted Admin Privileges https://detection.fyi/sigmahq/sigma/cloud/gcp/gworkspace/admin/gcp_gworkspace_user_granted_admin_privileges/ Tue, 28 Apr 2026 00:48:14 +0000 https://detection.fyi/sigmahq/sigma/cloud/gcp/gworkspace/admin/gcp_gworkspace_user_granted_admin_privileges/ Detects when an Google Workspace user is granted admin privileges.