GSuite User Two Step Verification Change

AnalysisType: rule
Filename: gsuite_two_step_verification.py
RuleID: "GSuite.TwoStepVerification"
DisplayName: "GSuite User Two Step Verification Change"
Enabled: true
LogTypes:
  - GSuite.ActivityEvent
Tags:
  - GSuite
  - Defense Evasion:Modify Authentication Process
Reports:
  MITRE ATT&CK:
    - TA0005:T1556
Severity: Low
Description: >
  A user disabled two step verification for themselves.
Reference: https://support.google.com/mail/answer/185839?hl=en&co=GENIE.Platform%3DDesktop&sjid=864417124752637253-EU
Runbook: >
  Depending on company policy, either suggest or require the user re-enable two step verification.
SummaryAttributes:
  - actor:email
Tests:
  - Name: Two Step Verification Enabled
    ExpectedResult: false
    Log:
      {
        "id": { "applicationName": "user_accounts" },
        "actor": { "callerType": "USER", "email": "some.user@somedomain.com" },
        "kind": "admin#reports#activity",
        "type": "2sv_change",
        "name": "2sv_enroll",
      }
  - Name: Two Step Verification Disabled
    ExpectedResult: True
    Log:
      {
        "id": { "applicationName": "user_accounts" },
        "actor": { "callerType": "USER", "email": "some.user@somedomain.com" },
        "kind": "admin#reports#activity",
        "type": "2sv_change",
        "name": "2sv_disable",
      }


# ------ paired body: gsuite_two_step_verification.py ------

def rule(event):
    if event.deep_get("id", "applicationName") != "user_accounts":
        return False

    if event.get("type") == "2sv_change" and event.get("name") == "2sv_disable":
        return True

    return False


def title(event):
    return (
        f"Two step verification was disabled for user"
        f" [{event.deep_get('actor', 'email', default='<UNKNOWN_USER>')}]"
    )