Suspicious Google Workspace Government Attack Warning (via google_workspace.login)

title: Suspicious Google Workspace Government Attack Warning (via google_workspace.login)
id: 8797bcf9-f616-515b-a671-7cc09fccdebc
status: stable
description: This rule detects a login attempt in Google Workspace flagged as a potential attack by a government-backed threat actor
references:
    - https://attack.mitre.org/techniques/T1078/
    - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging
    - https://cloud.google.com/logging/docs/audit/understanding-audit-logs
    - https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#gov_attack_warning
author: Huntrule Team
date: 2026-01-06
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.initial-access
    - attack.impact
    - attack.stealth
    - attack.t1078
logsource:
    product: gcp
    service: google_workspace.login
detection:
    selection:
        protoPayload.serviceName: 'login.googleapis.com'
        protoPayload.metadata.event.eventName: 'gov_attack_warning'
    condition: selection
falsepositives:
    - Unknown
level: medium