Google Workspace 2SV disabled
Google Workspace 2-step verification was turned off for an account (a 2sv_disable login event, or an admin enforcement change).
What it detects
Google Workspace 2-step verification was turned off for an account (a 2sv_disable login event, or an admin enforcement change). Disabling 2SV strips a key account protection and is frequently seen right before or after a Workspace account takeover.
MITRE ATT&CK mapping
- T1556Modify Authentication Process· Persistence
False positives and triage
Users occasionally disable 2SV when replacing a device; admins may adjust enforcement during rollout. Confirm the change was expected and that the account shows no other anomalies (new location, mail rules) around the same time.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 80%. Source: rules/cloud/gws_2sv_disabled.yaml, licensed under the Apache License 2.0.
id: cloud.gws.2sv_disabled
version: 1.0.0
status: stable
severity: high
confidence: 0.8
platforms: [application]
mitre_techniques: [T1556]
description: |
Google Workspace 2-step verification was turned off for an account (a `2sv_disable`
login event, or an admin enforcement change). Disabling 2SV strips a key account
protection and is frequently seen right before or after a Workspace account takeover.
match:
provider: GoogleWorkspace
event_action_any:
- 2sv_disable
- titanium_unenroll
- ENFORCE_STRONG_AUTHENTICATION
correlation_keys: [user_name]
false_positive_guidance: |
Users occasionally disable 2SV when replacing a device; admins may adjust enforcement
during rollout. Confirm the change was expected and that the account shows no other
anomalies (new location, mail rules) around the same time.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.