GCP-IAM - Organisation Policy Modification or Deletion
This rule monitors GCP audit logs for the modification, creation, or deletion of organization policies. These actions are often associated with an attacker attempting to weaken the security posture of the cloud environment by modifying or disabling restrictive security configurations.
Sigma
