Google Workspace: Detect gov_attack_warning login events from login.googleapis.com

title: "Google Workspace: Detect gov_attack_warning login events from login.googleapis.com"
id: 6059ef63-aaa7-4a65-a6e1-65485bb32886
status: experimental
description: This rule flags Google Workspace login attempts where the audit eventName is gov_attack_warning. Such alerts matter because they indicate the login was classified as a potential government-backed threat by the Workspace risk signals. Detection relies on GCP audit telemetry for protoPayload.serviceName and the specific eventName metadata fields emitted for Google Workspace logins.
references:
  - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging
  - https://cloud.google.com/logging/docs/audit/understanding-audit-logs
  - https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#gov_attack_warning
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/gworkspace/login/gcp_gworkspace_govattack.yml
author: Tom Kluter, Huntrule Team
date: 2026-04-28
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.initial-access
  - attack.impact
  - attack.stealth
  - attack.t1078
logsource:
  product: gcp
  service: google_workspace.login
detection:
  selection:
    protoPayload.serviceName: login.googleapis.com
    protoPayload.metadata.event.eventName: gov_attack_warning
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: eafe6f2b-cfec-4612-aec2-49563c33a087
    type: derived