huntrule

Google Workspace Logins Marked Suspicious by Google (GCP)

Alerts on Google Workspace login audit events classified by Google as suspicious, including less secure app and programmatic login types.

FreeUnreviewedSigmamediumv1
title: Google Workspace Logins Marked Suspicious by Google (GCP)
id: 7478c96e-af6d-4f54-a5db-ca9d4d758f1a
status: experimental
description: This rule flags Google Workspace login events where Google classifies the activity as suspicious, including less secure app logins, generic suspicious logins, and suspicious programmatic logins. Such classifications can indicate account access attempts that bypass normal user behavior, which is commonly abused during initial access or persistence. It relies on GCP Audit Log events from the login.googleapis.com service with specific eventName values recorded in protoPayload metadata.
references:
  - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging
  - https://cloud.google.com/logging/docs/audit/understanding-audit-logs
  - https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#suspicious_login
  - https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#suspicious_login_less_secure_app
  - https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#suspicious_programmatic_login
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/gworkspace/login/gcp_gworkspace_suspicious_login.yml
author: Tom Kluter, Huntrule Team
date: 2026-04-28
tags:
  - attack.initial-access
  - attack.privilege-escalation
  - attack.persistence
  - attack.stealth
  - attack.t1078.004
logsource:
  product: gcp
  service: google_workspace.login
detection:
  selection:
    protoPayload.Servicename: login.googleapis.com
    protoPayload.metadata.event.eventName:
      - suspicious_login_less_secure_app
      - suspicious_login
      - suspicious_programmatic_login
  condition: selection
falsepositives:
  - Legitimate logins
level: medium
license: DRL-1.1
related:
  - id: 38360161-76c4-4283-842e-efcf997dafc8
    type: derived

What it detects

This rule flags Google Workspace login events where Google classifies the activity as suspicious, including less secure app logins, generic suspicious logins, and suspicious programmatic logins. Such classifications can indicate account access attempts that bypass normal user behavior, which is commonly abused during initial access or persistence. It relies on GCP Audit Log events from the login.googleapis.com service with specific eventName values recorded in protoPayload metadata.

Known false positives

  • Legitimate logins

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.