A Google Workspace identity created, assigned or modified a role

Synopsis

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	2 Days
Required Data	Requires: Google Workspace Audit Logs
Detection Modules	Identity Threat Module
ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Valid Accounts (T1078)
Severity	Informational

A Google Workspace identity created, assigned or modified a delegated admin role.

An adversary may create, assign or modify a role to elevate the permissions of other user accounts and persist in their target's environment.

Check if the identity intended to perform this action, or look for signs that the user account is compromised (e.g. abnormal logins, unusual activity).
Check the identity's role designation in the organization.
Follow further actions done by the account.

A Google Workspace identity created, assigned or modified a delegated admin role.

An adversary may create, assign or modify a role to elevate the permissions of other user accounts and persist in their target's environment.

Check if the identity intended to perform this action, or look for signs that the user account is compromised (e.g. abnormal logins, unusual activity).
Check the identity's role designation in the organization.
Follow further actions done by the account.

A Google Workspace identity created, assigned or modified a delegated admin role.

An adversary may create, assign or modify a role to elevate the permissions of other user accounts and persist in their target's environment.

Check if the identity intended to perform this action, or look for signs that the user account is compromised (e.g. abnormal logins, unusual activity).
Check the identity's role designation in the organization.
Follow further actions done by the account.

A Google Workspace identity created, assigned or modified a delegated admin role.

An adversary may create, assign or modify a role to elevate the permissions of other user accounts and persist in their target's environment.

Check if the identity intended to perform this action, or look for signs that the user account is compromised (e.g. abnormal logins, unusual activity).
Check the identity's role designation in the organization.
Follow further actions done by the account.