Suspicious Login Activity Classified By Google

calendar Apr 28, 2026 · attack.initial-access attack.privilege-escalation attack.persistence attack.stealth attack.t1078.004  ·
Share on: linkedin copy

Detects Google Workspace login activity that's classified as suspicious by Google.

Sigma rule (View on GitHub)

 1title: Suspicious Login Activity Classified By Google
 2id: 38360161-76c4-4283-842e-efcf997dafc8
 3status: experimental
 4description: Detects Google Workspace login activity that's classified as suspicious by Google.
 5references:
 6    - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging
 7    - https://cloud.google.com/logging/docs/audit/understanding-audit-logs
 8    - https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#suspicious_login
 9    - https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#suspicious_login_less_secure_app
10    - https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#suspicious_programmatic_login
11author: Tom Kluter
12date: 2026-04-28
13tags:
14    - attack.initial-access
15    - attack.privilege-escalation
16    - attack.persistence
17    - attack.stealth
18    - attack.t1078.004
19logsource:
20    product: gcp
21    service: google_workspace.login
22detection:
23    selection:
24        protoPayload.Servicename: 'login.googleapis.com'
25        protoPayload.metadata.event.eventName:
26            - 'suspicious_login_less_secure_app'
27            - 'suspicious_login'
28            - 'suspicious_programmatic_login'
29    condition: selection
30falsepositives:
31    - Legitimate logins
32level: medium

References

Related rules

to-top