Detectionmediumexperimental

Suspicious Login Activity Classified By Google

Detects Google Workspace login activity that's classified as suspicious by Google.

Open in Detection Lab

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Tom KluterCreated Tue Apr 28Updated Mon Sep 1438360161-76c4-4283-842e-efcf997dafc8cloud

Log Source

Google Cloudgoogle_workspace.login

ProductGoogle Cloud← raw: gcp

Servicegoogle_workspace.login← raw: google_workspace.login

Detection Logic

detection:
    selection:
        protoPayload.serviceName: 'login.googleapis.com'
        protoPayload.metadata.event.eventName:
            - 'suspicious_login_less_secure_app'
            - 'suspicious_login'
            - 'suspicious_programmatic_login'
    condition: selection

False Positives

Legitimate logins

References

developers.google.com

Resolving title…

developers.google.com

Resolving title…