Suspicious Login Activity Classified By Google

calendar Sep 24, 2026 · attack.initial-access attack.privilege-escalation attack.persistence attack.stealth attack.t1078.004  ·
Share on: linkedin copy

Detects Google Workspace login activity that's classified as suspicious by Google.

Sigma rule (View on GitHub)

 1title: Suspicious Login Activity Classified By Google
 2id: 38360161-76c4-4283-842e-efcf997dafc8
 3status: experimental
 4description: Detects Google Workspace login activity that's classified as suspicious by Google.
 5references:
 6    - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging
 7    - https://cloud.google.com/logging/docs/audit/understanding-audit-logs
 8    - https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#suspicious_login
 9    - https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#suspicious_login_less_secure_app
10    - https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#suspicious_programmatic_login
11author: Tom Kluter
12date: 2026-04-28
13modified: 2026-09-14
14tags:
15    - attack.initial-access
16    - attack.privilege-escalation
17    - attack.persistence
18    - attack.stealth
19    - attack.t1078.004
20logsource:
21    product: gcp
22    service: google_workspace.login
23detection:
24    selection:
25        protoPayload.serviceName: 'login.googleapis.com'
26        protoPayload.metadata.event.eventName:
27            - 'suspicious_login_less_secure_app'
28            - 'suspicious_login'
29            - 'suspicious_programmatic_login'
30    condition: selection
31falsepositives:
32    - Legitimate logins
33level: medium

References

Related rules

to-top