Login

eventName	Description	Sample	Rule
any	Source-only rules that filter on applicationName 'login' without specifying an eventName attribute here.	N	Y
2sv_disable	A user disabled 2-Step Verification on their account.	N	Y
email_forwarding_out_of_domain	A user configured automatic email forwarding to an external address.	Y	Y
gov_attack_warning	Google detected that the account may have been targeted by a government-backed attacker.	N	Y
login_failure	A user authentication attempt failed.	Y	Y
login_success	A user successfully authenticated to Google Workspace.	Y	Y
suspicious_login	Google detected a suspicious login attempt on the account.	N	Y
suspicious_login_less_secure_app	A suspicious login from a less-secure application was detected.	N	Y
suspicious_programmatic_login	A suspicious programmatic (API or app) login was detected.	N	Y
2sv_enroll	A user enrolled in 2-Step Verification.	Y	N
logout	A user signed out of their Google Workspace account.	Y	N
login_challenge	A login challenge (e.g. an additional verification step) was presented to the user.	Y	N
login_verification	A user completed a login verification step.	Y	N
password_edit	A user changed their own account password.	Y	N
recovery_email_edit	A user changed their account recovery email address.	N	N
recovery_phone_edit	A user changed their account recovery phone number.	N	N
account_disabled_generic	A user account was disabled for a policy reason.	N	Y
account_disabled_spamming	A user account was disabled because it was found to be sending spam.	N	Y
account_disabled_hijacked	A user account was disabled because it was detected as hijacked.	N	Y
account_disabled_password_leak	A user account was disabled because a password leak was detected.	N	Y
risky_sensitive_action_allowed	A risky or sensitive action by a user was allowed after risk evaluation.	N	N
risky_sensitive_action_blocked	A risky or sensitive action by a user was blocked after risk evaluation.	N	N
passkey_enrolled	A user enrolled a passkey as a login method.	N	N
passkey_removed	A user removed a passkey login method.	N	N
titanium_enroll	A user enrolled in Google's Advanced Protection Program (Titanium).	N	N
titanium_unenroll	A user left Google's Advanced Protection Program (Titanium).	N	N
blocked_sender	An email sender was blocked by a user or policy.	N	N
user_signed_out_due_to_suspicious_session_cookie	A user was signed out because a suspicious session cookie was detected.	N	N
account_disabled_spamming_through_relay	A user account was disabled for sending spam through a relay.	N	Y

any: Login (any event)

ApplicationName: login

Description

Source-only rules that filter on applicationName 'login' without specifying an eventName attribute here.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Google Workspace Login Flagged Suspicious source low application-level: Surfaces Google Workspace sign-in events that Google's identity risk engine has flagged as suspicious via the is_suspicious field on the login activity record. This is Google's own ML-driven sign-in risk signal. The field is set by Google server-side based on signals like sign-ins from anonymizer infrastructure, known-malicious IP ranges, atypical user characteristics, or anomalous device fingerprints. Use this signal as enrichment alongside the other Workspace sign-in rules rather than as a standalone alert. This rule is a building block. It does not generate user-facing alerts by default but populates signal.rule.building_block_type for correlation rules or analyst pivots.T1078, T1078.004, T1528, T1557

References #

Reports API: login activity events

2sv_disable: 2-Step Verification Disabled

ApplicationName: login

Description

A user disabled 2-Step Verification on their account.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Google Workspace 2SV Policy Disabled By User source high: Detects when a Google Workspace user disables 2-step verification (2SV) on their account. An adversary with access to a compromised account may remove 2SV to eliminate the second authentication factor, leaving password-only access and making future sign-ins easier to abuse, relay, or maintain without triggering MFA challenges.T1556

References #

email_forwarding_out_of_domain: Email Forwarding Out of Domain

ApplicationName: login

Description

A user configured automatic email forwarding to an external address.

Example Audit Activity #

{
  "kind": "admin#reports#activity",
  "id": {
    "time": "2022-08-02T07:09:00.429Z",
    "uniqueQualifier": "-6303014327256218067",
    "applicationName": "login",
    "customerId": "C00mpaiwz"
  },
  "etag": "\"_ZVRqe-BUDYcYeOIPo-gm6Eh1QaGne4ACjHHI6qsr6A/eX21ZbPwRdPn_RAUHIoqPXKgjqc\"",
  "actor": {
    "callerType": "USER",
    "email": "workspace@cloud-response.com",
    "profileId": "102509620547980436027"
  },
  "ipAddress": "31.171.152.13",
  "events": [
    {
      "type": "email_forwarding_change",
      "name": "email_forwarding_out_of_domain",
      "parameters": [
        {
          "name": "email_forwarding_destination_address",
          "value": "korstiaanstam@gmail.com"
        }
      ]
    }
  ]
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Google Workspace Out Of Domain Email Forwarding source medium: Detects automatic email forwarding to external domains in Google Workspace, which may indicate data leakage or misuse.T1114, T1114.003

Panther #

Gsuite Mail forwarded to external domain source medium: A user has configured mail forwarding to an external domainT1114

References #

gov_attack_warning: Government-Backed Attack Warning

ApplicationName: login

Description

Google detected that the account may have been targeted by a government-backed attacker.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Google Workspace Government Attack Warning source medium: Detects a login attempt in Google Workspace flagged as a potential attack by a government-backed threat actorT1078

Panther #

GSuite Government Backed Attack source critical: Detects Google Workspace warnings of government-backed attacks targeting user accounts, issued only when indicators match nation-state threat actors or APT groups. These sophisticated attacks target high-value individuals using advanced tactics including zero-day exploits, spear-phishing, and social engineering. Successful compromise can lead to persistent access, intellectual property theft, and supply chain attacks.T1566, T1589, T1595

References #

login_failure: Login Failure

ApplicationName: login

Example Audit Activity #

{
  "kind": "admin#reports#activity",
  "id": {
    "time": "2022-07-27T11:43:09.564Z",
    "uniqueQualifier": "258855114937",
    "applicationName": "login",
    "customerId": "C00mpaiwz"
  },
  "etag": "\"_ZVRqe-BUDYcYeOIPo-gm6Eh1QaGne4ACjHHI6qsr6A/9_N8Biu-eMnZp8mlJhJWtd9quMI\"",
  "actor": {
    "email": "workspace@cloud-response.com",
    "profileId": "102509620547980436027"
  },
  "ipAddress": "138.199.47.184",
  "events": [
    {
      "type": "login",
      "name": "login_failure",
      "parameters": [
        {
          "name": "login_type",
          "value": "unknown"
        },
        {
          "name": "login_challenge_method",
          "multiValue": [
            "password"
          ]
        }
      ]
    }
  ]
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`event.parameters{}.multiValue{}` (splunk rule field)	in	`backup_code`	2 rules	splunk
`event.parameters{}.multiValue{}` (splunk rule field)	in	`google_authenticator`	2 rules	splunk
`event.parameters{}.multiValue{}` (splunk rule field)	in	`google_prompt`	2 rules	splunk
`event.parameters{}.multiValue{}` (splunk rule field)	in	`idv_any_phone`	2 rules	splunk
`event.parameters{}.multiValue{}` (splunk rule field)	in	`idv_preregistered_phone`	2 rules	splunk
`event.parameters{}.multiValue{}` (splunk rule field)	in	`internal_two_factor`	2 rules	splunk
`event.parameters{}.multiValue{}` (splunk rule field)	in	`knowledge_employee_id`	2 rules	splunk
`event.parameters{}.multiValue{}` (splunk rule field)	in	`knowledge_preregistered_email`	2 rules	splunk
`event.parameters{}.multiValue{}` (splunk rule field)	in	`knowledge_preregistered_phone`	2 rules	splunk
`event.parameters{}.multiValue{}` (splunk rule field)	in	`login_location`	2 rules	splunk
`event.parameters{}.multiValue{}` (splunk rule field)	in	`offline_otp`	2 rules	splunk
`event.parameters{}.multiValue{}` (splunk rule field)	in	`security_key`	2 rules	splunk
`event.parameters{}.multiValue{}` (splunk rule field)	in	`security_key_otp`	2 rules	splunk
`mfa_prompts` (splunk rule field)	ge	`10`	1 rule	splunk

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Splunk #

GCP Authentication Failed During MFA Challenge source: The following analytic detects failed authentication attempts during the Multi-Factor Authentication (MFA) challenge on a Google Cloud Platform (GCP) tenant. It uses Google Workspace login failure events to identify instances where MFA…T1078, T1078.004, T1586, T1586.003, T1621
GCP Multiple Failed MFA Requests For User source: The following analytic detects multiple failed multi-factor authentication (MFA) requests for a single user within a Google Cloud Platform (GCP) tenant. It triggers when 10 or more MFA prompts fail within a 5-minute window, using Google…T1078, T1078.004, T1586, T1586.003, T1621
GCP Multiple Users Failing To Authenticate From Ip source: The following analytic detects a single source IP address failing to authenticate into more than 20 unique Google Workspace user accounts within a 5-minute window. It leverages Google Workspace login failure events to identify potential…T1110, T1110.003, T1110.004, T1586, T1586.003

Show 1 more (4 total) on the rules page

login_success: Login Success

ApplicationName: login

Example Audit Activity #

{
  "kind": "admin#reports#activity",
  "id": {
    "time": "2022-08-15T16:24:08.797Z",
    "uniqueQualifier": "722534617001",
    "applicationName": "login",
    "customerId": "C00mpaiwz"
  },
  "etag": "\"_ZVRqe-BUDYcYeOIPo-gm6Eh1QaGne4ACjHHI6qsr6A/2CgOqjKcY53SeawmLirmLuQvpoU\"",
  "actor": {
    "email": "admin@cloud-response.com",
    "profileId": "111440584475724055600"
  },
  "ipAddress": "209.94.244.98",
  "events": [
    {
      "type": "login",
      "name": "login_success",
      "parameters": [
        {
          "name": "login_type",
          "value": "google_password"
        },
        {
          "name": "login_challenge_method",
          "multiValue": [
            "password"
          ]
        },
        {
          "name": "is_suspicious",
          "boolValue": false
        }
      ]
    }
  ]
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`about.labels["is_suspicious"] (Chronicle)`	eq	`true`	2 rules	chronicle
`user.email` (elastic rule field)	is_not_null		2 rules	elastic
`Esql.distance_km` (elastic rule field)	ge	`500`	1 rule	elastic
`Esql.region_count` (elastic rule field)	ge	`2`	1 rule	elastic
`Esql.region_count` (elastic rule field)	le	`5`	1 rule	elastic
`Esql.travel_kmh` (elastic rule field)	ge	`800`	1 rule	elastic
`source.geo.country_name` (elastic rule field)	is_not_null		1 rule	elastic
`source.geo.location` (elastic rule field)	is_not_null		1 rule	elastic
`source.geo.region_name` (elastic rule field)	is_not_null		1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Google Workspace User Login with Unusual ASN source low: Detects the first time a Google Workspace user successfully signs in from a given source ASN within a 14-day historical window. Most users have a stable set of egress ASNs (home ISP, corporate VPN, mobile carrier). A new ASN for a user is a meaningful anomaly as it surfaces ISP changes and travel, but also catches AiTM phishing-kit relays whose egress ASN was never previously associated with the user.T1078, T1078.004, T1528, T1557
Google Workspace Impossible Travel Login source high: Detects successful Google Workspace sign-ins for the same user from two geographically separated locations within a 90-minute window, where the implied travel speed between the two points exceeds what is physically possible (>=800 km/h, faster than modern commercial airliners) and the geographic separation is at least 500 km. This pattern indicates either VPN/proxy use or an adversary signing in to a compromised account from a different location than the legitimate user.T1078, T1078.004, T1528, T1557

Splunk #

GCP Successful Single-Factor Authentication source: The following analytic identifies a successful single-factor authentication event against Google Cloud Platform (GCP) for an account without Multi-Factor Authentication (MFA) enabled. It uses Google Workspace login event data to detect…T1078, T1078.004, T1586, T1586.003

YARA-L #

Google Workspace Suspicious Login and Google Drive File Download source high: Identifies when a Google Workspace user downloads a file from Google Drive after a suspicious login event occurred.T1567
Google Workspace Suspicious Login and Google Drive File Share source high: Identifies when a Google Workspace user shares a file on Google Drive after a suspicious login event occurred.T1567

Panther #

Google Workspace Rapid Multi-IP Authentication source: Detects users authenticating from 3+ distinct IPv4 addresses within 6 hours. May indicate GAIA credential theft where stolen OAuth tokens are used across multiple compromised machines simultaneously. IPv6 addresses are excluded to avoid false positives from dual-stack networking.
Google Workspace Rapid Multi-IP Authentication source medium linked query: Google Workspace Rapid Multi-IP Authentication: Alerts when users authenticate from 3+ distinct IPv4 addresses within 6 hours. This pattern may indicate GAIA credential theft where attackers use stolen OAuth tokens across multiple compromised machines simultaneously. IPv6 addresses are excluded to avoid false positives from dual-stack networking environments.T1078.004, T1550

suspicious_login: Suspicious Login

ApplicationName: login

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Suspicious Login Activity Classified By Google source medium: Detects Google Workspace login activity that's classified as suspicious by Google.T1078, T1078.004↳ also matches suspicious_login_less_secure_app: Suspicious Login (Less Secure App), suspicious_programmatic_login: Suspicious Programmatic Login

suspicious_login_less_secure_app: Suspicious Login (Less Secure App)

ApplicationName: login

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

suspicious_programmatic_login: Suspicious Programmatic Login

ApplicationName: login

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

2sv_enroll: 2-Step Verification Enrolled

ApplicationName: login

Description

A user enrolled in 2-Step Verification.

Example Audit Activity #

{
  "kind": "admin#reports#activity",
  "id": {
    "time": "2022-08-02T07:08:03.018Z",
    "uniqueQualifier": "8958327431473786420",
    "applicationName": "login",
    "customerId": "C00mpaiwz"
  },
  "etag": "\"_ZVRqe-BUDYcYeOIPo-gm6Eh1QaGne4ACjHHI6qsr6A/gue2aWDXgcYABQA12lXY6OefZqI\"",
  "actor": {
    "callerType": "USER",
    "email": "workspace@cloud-response.com",
    "profileId": "102509620547980436027"
  },
  "ipAddress": "31.171.152.13",
  "events": [
    {
      "type": "2sv_change",
      "name": "2sv_enroll"
    }
  ]
}

References #

logout: Logout

ApplicationName: login

Description

A user signed out of their Google Workspace account.

Example Audit Activity #

{
  "kind": "admin#reports#activity",
  "id": {
    "time": "2022-08-11T11:47:59.530Z",
    "uniqueQualifier": "722534617001",
    "applicationName": "login",
    "customerId": "C00mpaiwz"
  },
  "etag": "\"_ZVRqe-BUDYcYeOIPo-gm6Eh1QaGne4ACjHHI6qsr6A/ONXCixZ4yd-kOQLjrgxX--m1WXA\"",
  "actor": {
    "email": "admin@cloud-response.com",
    "profileId": "111440584475724055600"
  },
  "ipAddress": "145.128.241.109",
  "events": [
    {
      "type": "login",
      "name": "logout",
      "parameters": [
        {
          "name": "login_type",
          "value": "google_password"
        }
      ]
    }
  ]
}

References #

login_challenge: Login Challenge

ApplicationName: login

Example Audit Activity #

{
  "kind": "admin#reports#activity",
  "id": {
    "time": "2022-08-02T08:59:41.940Z",
    "uniqueQualifier": "722534617001",
    "applicationName": "login",
    "customerId": "C00mpaiwz"
  },
  "etag": "\"_ZVRqe-BUDYcYeOIPo-gm6Eh1QaGne4ACjHHI6qsr6A/zl_FPiBAq3UOiT748_QcR6jJlZI\"",
  "actor": {
    "email": "admin@cloud-response.com",
    "profileId": "111440584475724055600"
  },
  "ipAddress": "122.155.174.97",
  "events": [
    {
      "type": "login",
      "name": "login_challenge",
      "parameters": [
        {
          "name": "login_type",
          "value": "google_password"
        },
        {
          "name": "login_challenge_method",
          "multiValue": [
            "google_authenticator"
          ]
        },
        {
          "name": "login_challenge_status",
          "value": "passed"
        }
      ]
    }
  ]
}

login_verification: Login Verification

ApplicationName: login

Example Audit Activity #

{
  "kind": "admin#reports#activity",
  "id": {
    "time": "2022-08-02T09:32:37.406Z",
    "uniqueQualifier": "258855114937",
    "applicationName": "login",
    "customerId": "C00mpaiwz"
  },
  "etag": "\"_ZVRqe-BUDYcYeOIPo-gm6Eh1QaGne4ACjHHI6qsr6A/NkmfyGAZiDNDKeAlfNYlVMtgn5s\"",
  "actor": {
    "email": "workspace@cloud-response.com",
    "profileId": "102509620547980436027"
  },
  "ipAddress": "122.155.174.97",
  "events": [
    {
      "type": "login",
      "name": "login_verification",
      "parameters": [
        {
          "name": "login_type",
          "value": "google_password"
        },
        {
          "name": "login_challenge_method",
          "multiValue": [
            "idv_preregistered_phone"
          ]
        },
        {
          "name": "login_challenge_status",
          "value": "passed"
        },
        {
          "name": "is_second_factor",
          "boolValue": true
        }
      ]
    }
  ]
}

password_edit: Password Edit

ApplicationName: login

Description

A user changed their own account password.

Example Audit Activity #

{
  "kind": "admin#reports#activity",
  "id": {
    "time": "2022-07-21T13:40:49.268Z",
    "uniqueQualifier": "-6977913962455696939",
    "applicationName": "login",
    "customerId": "C00mpaiwz"
  },
  "etag": "\"_ZVRqe-BUDYcYeOIPo-gm6Eh1QaGne4ACjHHI6qsr6A/CwHnq63zM9H90cAS3G08NJhI9qw\"",
  "actor": {
    "callerType": "USER",
    "email": "suspicious@cloud-response.com",
    "profileId": "102509620547980436027"
  },
  "ipAddress": "80.114.222.200",
  "events": [
    {
      "type": "password_change",
      "name": "password_edit"
    }
  ]
}

References #

recovery_email_edit: Recovery Email Edit

ApplicationName: login

Description

A user changed their account recovery email address.

References #

recovery_phone_edit: Recovery Phone Edit

ApplicationName: login

Description

A user changed their account recovery phone number.

References #

account_disabled_generic: Account Disabled (Generic)

ApplicationName: login

Description

A user account was disabled for a policy reason.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

GSuite User Suspended source high: A GSuite user was suspended, the account may have been compromised by a spam network.↳ also matches account_disabled_spamming: Account Disabled (Spamming), account_disabled_hijacked: Account Disabled (Hijacked), account_disabled_spamming_through_relay: User Suspended (Spam Through Relay)

References #

account_disabled_spamming: Account Disabled (Spamming)

ApplicationName: login

Description

A user account was disabled because it was found to be sending spam.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

GSuite User Suspended source high: A GSuite user was suspended, the account may have been compromised by a spam network.↳ also matches account_disabled_generic: Account Disabled (Generic), account_disabled_hijacked: Account Disabled (Hijacked), account_disabled_spamming_through_relay: User Suspended (Spam Through Relay)

References #

account_disabled_hijacked: Account Disabled (Hijacked)

ApplicationName: login

Description

A user account was disabled because it was detected as hijacked.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

GSuite User Suspended source high: A GSuite user was suspended, the account may have been compromised by a spam network.↳ also matches account_disabled_generic: Account Disabled (Generic), account_disabled_spamming: Account Disabled (Spamming), account_disabled_spamming_through_relay: User Suspended (Spam Through Relay)

References #

account_disabled_password_leak: Account Disabled (Password Leak)

ApplicationName: login

Description

A user account was disabled because a password leak was detected.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

GSuite User Password Leaked source high: GSuite reported a user's password has been compromised, so they disabled the account.T1552

References #

risky_sensitive_action_allowed: Risky Sensitive Action Allowed

ApplicationName: login

Description

A risky or sensitive action by a user was allowed after risk evaluation.

References #

risky_sensitive_action_blocked: Risky Sensitive Action Blocked

ApplicationName: login

Description

A risky or sensitive action by a user was blocked after risk evaluation.

References #

passkey_enrolled: Passkey Enrolled

ApplicationName: login

Description

A user enrolled a passkey as a login method.

References #

passkey_removed: Passkey Removed

ApplicationName: login

Description

A user removed a passkey login method.

References #

titanium_enroll: Advanced Protection Enrolled

ApplicationName: login

Description

A user enrolled in Google's Advanced Protection Program (Titanium).

References #

titanium_unenroll: Advanced Protection Unenrolled

ApplicationName: login

Description

A user left Google's Advanced Protection Program (Titanium).

References #

blocked_sender: Blocked Sender

ApplicationName: login

Description

An email sender was blocked by a user or policy.

References #

account_disabled_spamming_through_relay: User Suspended (Spam Through Relay)

ApplicationName: login

Description

A user account was disabled for sending spam through a relay.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

GSuite User Suspended source high: A GSuite user was suspended, the account may have been compromised by a spam network.↳ also matches account_disabled_generic: Account Disabled (Generic), account_disabled_spamming: Account Disabled (Spamming), account_disabled_hijacked: Account Disabled (Hijacked)

Login

any: Login (any event)

Description

Detection Rules #

Elastic #

References #

2sv_disable: 2-Step Verification Disabled

Description

Detection Rules #

Elastic #

References #

email_forwarding_out_of_domain: Email Forwarding Out of Domain

Description

Example Audit Activity #

Detection Rules #

Sigma #

Panther #

References #

gov_attack_warning: Government-Backed Attack Warning

Description

Detection Rules #

Sigma #

Panther #

References #

login_failure: Login Failure

Description

Example Audit Activity #

Common Indicators #

Detection Rules #

Splunk #

Kusto #

References #

login_success: Login Success

Description

Example Audit Activity #

Common Indicators #

Detection Rules #

Elastic #

Splunk #

YARA-L #

Panther #

References #

suspicious_login: Suspicious Login

Description

Detection Rules #

Sigma #

Panther #

References #

suspicious_login_less_secure_app: Suspicious Login (Less Secure App)

Description

Detection Rules #

Sigma #

Panther #

References #

suspicious_programmatic_login: Suspicious Programmatic Login

Description

Detection Rules #

Sigma #

Panther #

References #

2sv_enroll: 2-Step Verification Enrolled

Description

Example Audit Activity #

References #

logout: Logout

Description

Example Audit Activity #

References #

login_challenge: Login Challenge

Description

Example Audit Activity #

References #

login_verification: Login Verification

Description

Example Audit Activity #

References #

password_edit: Password Edit

Description

Example Audit Activity #

References #