Google Workspace 2SV Policy Disabled

Google Workspace administrators can enforce 2-Step Verification (2SV) to enhance user account security, requiring users to verify their identity beyond simple login credentials. This policy can be configured with various verification methods and enrollment periods. However, a malicious actor with administrative privileges may disable 2SV policies to reduce the security requirements for accessing targeted accounts. This could be a precursor to credential access or data exfiltration. The Elastic detection rule "Google Workspace 2SV Policy Disabled" was released on 2022-08-26 and updated on 2026-04-10 to detect this activity. This activity is important for defenders because it can lead to unauthorized access to sensitive data and systems.

Attack Chain

1. An attacker gains unauthorized access to a Google Workspace administrator account, possibly through credential compromise or phishing.
2. The attacker authenticates to the Google Workspace admin console using the compromised credentials.
3. The attacker navigates to the Security settings within the admin console.
4. The attacker locates the 2-Step Verification settings.
5. The attacker disables the 2SV enforcement policy for specific organizational units or the entire domain. This generates a google_workspace.login event with event.action: "2sv_disable".
6. The attacker may then attempt to access user accounts without the 2SV requirement, potentially using previously obtained credentials.
7. Upon successful login, the attacker performs malicious actions such as accessing sensitive data, modifying configurations, or establishing persistence.
8. The attacker covers their tracks by deleting audit logs or creating new admin accounts with modified permissions.

Impact

Disabling 2SV weakens the overall security posture of a Google Workspace environment. If successful, attackers can gain unauthorized access to user accounts, leading to data breaches, financial losses, and reputational damage. The number of affected users depends on the scope of the 2SV policy change and the extent of the attacker's access. Organizations in any sector relying on Google Workspace for email, file storage, or other services are vulnerable.

Recommendation

• Deploy the provided Sigma rule to your SIEM to detect instances of 2SV policy being disabled and tune for your environment.
• Review Google Workspace audit logs (filebeat-*, logs-google_workspace*) for unexpected 2SV configuration changes.
• Implement the security best practices outlined by Google: https://support.google.com/a/answer/7587183
• Monitor user.name or source.user.email in the alert and filter event.dataset for google_workspace.login and aggregate by user.name, event.action to identify impacted users and authentication events.
• Reduce the var.interval in the Google Workspace Filebeat module to 10 minutes (10m) to decrease the risk of missed events.