Elastic medium stable eql

External User Added to Google Workspace Group

Detects an external Google Workspace user account being added to an existing group. Adversaries may add external user accounts as a means to intercept shared files or emails with that specific group.

View Source

Detection Logic

iam where data_stream.dataset == "google_workspace.admin" and event.action == "ADD_GROUP_MEMBER" and
  not endsWith(user.target.domain, user.target.group.domain)

False Positives

  • ⚠ Administrators may add external users to groups to share files and communication with them via the intended recipient be the group they are added to. It is unlikely an external user account would be added to an organization's group where administrators should create a new user account.

Field Validations

Loading…

Comments (0)

Loading comments...