[New Rule] Multiple self adds to Google Workspace user groups in short succession

[brokensound77]

Description

Detects multiple self add to Google Workspace user group in short succession, which could be indicative of attempts to Discover, Colletct, Exfil or perform recon.

Also, side note - what's the real difference between a user joining a group vs self adding to a group??

Target Ruleset

google_workspace

Target Rule Type

ES|QL

Tested ECS Version

No response

Query

from logs-google_workspace*
| mv_expand event.type
| where event.type == "group" and to_lower(event.action) == "add_user" and user.email == user.target.email
| stats total_requests = count(*) by source.user.name
| where total_requests > 5
| sort total_requests desc

can also be threshold

New fields required in ECS/data sources for this rule?

No response

Related issues or PRs

4129

References

No response

Redacted Example Data

No response

[brokensound77]

unintentional duplicate