Detection rules › By event

GoogleWorkspace-login

Event	Rules
any	1
2sv_disable	1
email_forwarding_out_of_domain	2
gov_attack_warning	2
login_failure	5
login_success	7
suspicious_login	2
suspicious_login_less_secure_app	2
suspicious_programmatic_login	2
account_disabled_generic	1
account_disabled_spamming	1
account_disabled_hijacked	1
account_disabled_password_leak	1
account_disabled_spamming_through_relay	1

any

1 detection rules reference this event. View event page.

Elastic (1)

Google Workspace Login Flagged Suspicious severity low building block T1078, T1078.004, T1528, T1557

2sv_disable

1 detection rules reference this event. View event page.

Elastic (1)

Google Workspace 2SV Policy Disabled By User severity high T1556

email_forwarding_out_of_domain

2 detection rules reference this event. View event page.

Sigma (1)

Google Workspace Out Of Domain Email Forwarding severity medium T1114, T1114.003

Panther (1)

Gsuite Mail forwarded to external domain severity medium T1114

gov_attack_warning

2 detection rules reference this event. View event page.

Sigma (1)

Google Workspace Government Attack Warning severity medium T1078

Panther (1)

GSuite Government Backed Attack severity critical T1566, T1589, T1595

login_failure

5 detection rules reference this event. View event page.

Splunk (4)

GCP Authentication Failed During MFA Challenge severity medium T1078, T1078.004, T1586, T1586.003, T1621
GCP Multiple Failed MFA Requests For User severity medium T1078, T1078.004, T1586, T1586.003, T1621
GCP Multiple Users Failing To Authenticate From Ip severity low T1110, T1110.003, T1110.004, T1586, T1586.003
GCP Unusual Number of Failed Authentications From Ip severity low T1110, T1110.003, T1110.004, T1586, T1586.003

Kusto (1)

GWorkspace - Possible brute force attack severity medium T1110

login_success

7 detection rules reference this event. View event page.

Elastic (2)

Google Workspace Impossible Travel Login severity high T1078, T1078.004, T1528, T1557
Google Workspace User Login with Unusual ASN severity low T1078, T1078.004, T1528, T1557

Splunk (1)

GCP Successful Single-Factor Authentication severity medium T1078, T1078.004, T1586, T1586.003

YARA-L (2)

Google Workspace Suspicious Login and Google Drive File Download severity high T1567
Google Workspace Suspicious Login and Google Drive File Share severity high T1567

Panther (2)

Google Workspace Rapid Multi-IP Authentication
Google Workspace Rapid Multi-IP Authentication severity medium T1078.004, T1550

account_disabled_generic

1 detection rules reference this event. View event page.

Panther (1)

GSuite User Suspended severity high

account_disabled_spamming

1 detection rules reference this event. View event page.

Panther (1)

GSuite User Suspended severity high

account_disabled_hijacked

1 detection rules reference this event. View event page.

Panther (1)

GSuite User Suspended severity high

account_disabled_password_leak

1 detection rules reference this event. View event page.

Panther (1)

GSuite User Password Leaked severity high T1552

account_disabled_spamming_through_relay

1 detection rules reference this event. View event page.

Panther (1)

GSuite User Suspended severity high