Mobile / Device Management

eventName	Description	Sample	Rule
any	Source-only rules that filter on applicationName 'mobile' without specifying an eventName attribute here.	N	N
DEVICE_REGISTER_UNREGISTER_EVENT	A mobile or managed device was registered or unregistered from Google Workspace MDM. Elastic uses dataset 'google_workspace.device' for this applicationName.	N	Y
DEVICE_COMPROMISED_EVENT	A managed device was detected as compromised or rooted/jailbroken.	N	Y
DEVICE_ACTION_EVENT	An administrative action was taken on a managed device (e.g. remote wipe, lock).	N	N
FAILED_PASSWORD_ATTEMPTS_EVENT	Multiple failed attempts to unlock a managed device were detected.	N	Y
SUSPICIOUS_ACTIVITY_EVENT	Suspicious activity was detected on a managed mobile device.	N	Y
DEVICE_SYNC_EVENT	A managed device synced with Google Workspace MDM.	N	N
DEVICE_COMPLIANCE_CHANGED_EVENT	A managed device's compliance status changed.	N	N

any: Mobile / Device Management (any event)

ApplicationName: mobile

Description

Source-only rules that filter on applicationName 'mobile' without specifying an eventName attribute here.

References #

Reports API: mobile activity events

DEVICE_REGISTER_UNREGISTER_EVENT: Device Register/Unregister Event

ApplicationName: mobile

Description

A mobile or managed device was registered or unregistered from Google Workspace MDM. Elastic uses dataset 'google_workspace.device' for this applicationName.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`google_workspace.device.account_state (GWS)`	eq	`registered`	2 rules	elastic
`user.email` (elastic rule field)	is_not_null		2 rules	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Google Workspace User Sign-in from Atypical Device Type source medium: Detects the first time a Google Workspace user is observed authenticating from a device of a given type (e.g., WINDOWS, MAC, ANDROID, IOS, LINUX) within a historical window. Note that "DEVICE_REGISTER_UNREGISTER_EVENT" events do not represent one-time physical device enrollments; the Google Reports API emits a fresh "google_workspace.device.id" on each event, and the same physical device may produce multiple events per day as sessions/sync renewals occur. The rule therefore surfaces a user authenticating from a new device type, not a new physical device. This is still high-fidelity because adversaries who compromise a Workspace identity via AiTM kits or stolen OAuth refresh tokens frequently relay sessions from device types that diverge from the legitimate user's baseline (e.g., a WINDOWS session appearing for a known macOS user, or simultaneous WINDOWS+MAC sessions within minutes), which is the canonical kit fingerprint. Because the underlying token retains access after password rotation, treat unexpected device-type divergence as a compromise indicator and revoke tokens, not just credentials.T1078, T1078.004, T1098, T1098.005
Google Workspace Device Registration Burst for Single User source medium: Detects bursts of Google Workspace device registration events for the same user, where three or more distinct "google_workspace.device.id" values are emitted in a one-minute window. Although "DEVICE_REGISTER_UNREGISTER_EVENT" fires routinely on session/sync registration and is not a true physical device enrollment, legitimate user activity typically produces fewer than three distinct device IDs in a single minute. A high-cardinality burst is the fingerprint behavior of AiTM phishing-kit relays (Tycoon2FA Google variant, EvilGinx phishlets) and stolen-OAuth-token replay tooling, both of which mint a new session attestation per relay or replay attempt.T1078, T1078.004, T1098, T1098.005, T1557