Rules referencing GoogleWorkspace-login catalog entries | detection.wiki

Detection rules › By catalog entry

Catalog entry	Rules
any	1
2sv_disable	1
email_forwarding_out_of_domain	2
gov_attack_warning	2
login_failure	5
login_success	7
suspicious_login	2
suspicious_login_less_secure_app	2
suspicious_programmatic_login	2
account_disabled_generic	1
account_disabled_spamming	1
account_disabled_hijacked	1
account_disabled_password_leak	1
account_disabled_spamming_through_relay	1

any

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

Google Workspace Login Flagged Suspicious severity low building block T1078,T1078.004,T1528,T1557

2sv_disable

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

Google Workspace 2SV Policy Disabled By User severity high T1556

email_forwarding_out_of_domain

2 detection rules reference this catalog entry. View catalog entry.

Sigma (1)

Google Workspace Out Of Domain Email Forwarding severity medium T1114,T1114.003

Panther (1)

Gsuite Mail forwarded to external domain severity medium T1114

gov_attack_warning

2 detection rules reference this catalog entry. View catalog entry.

Sigma (1)

Google Workspace Government Attack Warning severity medium T1078

Panther (1)

GSuite Government Backed Attack severity critical T1566,T1589,T1595

5 detection rules reference this catalog entry. View catalog entry.

Splunk (4)

Kusto (1)

GWorkspace - Possible brute force attack severity medium T1110

7 detection rules reference this catalog entry. View catalog entry.

Elastic (2)

Google Workspace Impossible Travel Login severity high T1078,T1078.004,T1528,T1557
Google Workspace User Login with Unusual ASN severity low T1078,T1078.004,T1528,T1557

Splunk (1)

GCP Successful Single-Factor Authentication severity medium T1078,T1078.004,T1586,T1586.003

YARA-L (2)

Google Workspace Suspicious Login and Google Drive File Download severity high T1567
Google Workspace Suspicious Login and Google Drive File Share severity high T1567

Panther (2)

Google Workspace Rapid Multi-IP Authentication
Google Workspace Rapid Multi-IP Authentication severity medium T1078.004,T1550

account_disabled_generic

1 detection rules reference this catalog entry. View catalog entry.

Panther (1)

GSuite User Suspended severity high

account_disabled_spamming

1 detection rules reference this catalog entry. View catalog entry.

Panther (1)

GSuite User Suspended severity high

account_disabled_hijacked

1 detection rules reference this catalog entry. View catalog entry.

Panther (1)

GSuite User Suspended severity high

account_disabled_password_leak

1 detection rules reference this catalog entry. View catalog entry.

Panther (1)

GSuite User Password Leaked severity high T1552

account_disabled_spamming_through_relay

1 detection rules reference this catalog entry. View catalog entry.

Panther (1)

GSuite User Suspended severity high

Back to all GoogleWorkspace-login catalog entries