GCP Audit Logs - Detect Organization Policy Deletion or Updation
Detects when a Google Cloud Platform organization policy is deleted or updated. Organization policies provide centralized control over your organization's cloud resources and help ensure security and compliance.…
Description
Detects when a Google Cloud Platform organization policy is deleted or updated. Organization policies provide centralized control over your organization's cloud resources and help ensure security and compliance. Deletion or modification of org policies may indicate an attempt to bypass security controls or weaken the security posture of GCP projects. Adversaries may delete or update organization policies to disable security constraints before performing malicious activities.
Detection logic
Detection requirements
- Platform
- ContainersIaaSLinuxmacOSNetwork DevicesWindows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
- Log source product
- gcpauditlogsdefinition
- Log source service
- gcpauditlogs
MITRE ATT&CK mappings
0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.
No references are available for this detection.
From the source
- At source
- Open at source
- Upstream identifier
- 205e1c9f-faee-43f1-b3b8-1952ffbbeea4
- Tagged by the source as
- DefenseEvasion
Licence
- Published under
- MIT LicenseRead the licence
- Attribution
- Required
- Obtained under
- MITRead the origin licence
Authorship
- Published
- Sep 1, 2026
- Version
- 1