Google Workspace Admin Role Assignment
Identifies when an administrator role is assigned to a user account in Google Workspace. Security teams can monitor for the malicious or accidental assignment of administrator privileges to prevent unauthorized access to data. The rule specifically looks for `USER_RESOURCE_UPDATE_PERMISSIONS` events with `ASSIGN_ROLE` as the product event type and `DELEGATED_ADMIN_SETTINGS` in the security result category details. It also calculates a higher risk score if the assigned role is `_SEED_ADMIN_ROLE`.
YARA-L
