value:  Some actors and malware will attempt to launch commands, via PowerShell for example (among others), to gather cloud group user settings and permissions for Google with the command: ‘GET https://cloudidentity.googleapis.com/v1/groups’. 
name: Permission Groups Discovery: Cloud Groups