Google Workspace Application Access Level Modified

SigmaHQ Detections@sigmaHQ

•updated Dec 1, 2024•0•48

Detects when an access level is changed for a Google Workspace application. An access level is part of BeyondCorp Enterprise which is Google Workspace's way of enforcing Zero Trust model. An adversary could remove access levels to gain easier access to Google Workspace resources, potentially leading to persistence or privilege escalation.