Data Source: Google Workspace User Log Events | Detection.FYI

Google Workspace User Login with Unusual ASN

May 22, 2026 · Domain: Cloud Domain: Identity Data Source: Google Workspace Data Source: Google Workspace Audit Logs Data Source: Google Workspace User Log Events Use Case: Threat Detection Use Case: Identity and Access Audit Tactic: Initial Access Tactic: Credential Access Resources: Investigation Guide ·
Share on:

Detects the first time a Google Workspace user successfully signs in from a given source ASN within a 14-day historical window. Most users have a stable set of egress ASNs (home ISP, corporate VPN, mobile carrier). A new ASN for a user is a meaningful anomaly as it surfaces ISP changes and travel, but also catches AiTM phishing-kit relays whose egress ASN was never previously associated with the user.

Read More