Google Workspace User Organizational Unit Changed
This rule identifies when a Google Workspace user account is moved between Organizational Units (OUs). This activity can be a legitimate administrative action, but it can also be used by an attacker to move a compromised account to an OU with different policies, potentially granting them more privileges or evading existing security controls. For example, an attacker might move an account to an OU with less stringent multi-factor authentication requirements or different access policies to sensitive data.
YARA-L
