Google Workspace user created
A new Google Workspace user account was created.
What it detects
A new Google Workspace user account was created. New-account creation is a common persistence technique in cloud tenants — an attacker with admin access can mint a durable identity that survives a password reset of the originally-compromised account. Flagged for review, not as a confirmed threat.
MITRE ATT&CK mapping
- T1136.003Create Account: Cloud Account· Persistence
False positives and triage
Routine onboarding creates users constantly; this is a low-severity awareness signal. It matters most when the creating admin, timing, or naming is anomalous, or when it follows other suspicious admin activity.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/cloud/gws_user_created.yaml, licensed under the Apache License 2.0.
id: cloud.gws.user_created
version: 1.0.0
status: stable
severity: medium
confidence: 0.6
platforms: [application]
mitre_techniques: [T1136.003]
description: |
A new Google Workspace user account was created. New-account creation is a common
persistence technique in cloud tenants — an attacker with admin access can mint a
durable identity that survives a password reset of the originally-compromised account.
Flagged for review, not as a confirmed threat.
match:
provider: GoogleWorkspace
event_action_any:
- CREATE_USER
- UNDELETE_USER
correlation_keys: [user_name]
false_positive_guidance: |
Routine onboarding creates users constantly; this is a low-severity awareness signal. It
matters most when the creating admin, timing, or naming is anomalous, or when it follows
other suspicious admin activity.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.