Google Workspace Role Modified or Deleted
Detects when a role is modified or deleted in Google Workspace. This could indicate an attacker attempting to escalate privileges, maintain persistence, or disrupt services by altering administrative roles.
Sigma
