GCP Successful Single-Factor Authentication

Status: production
Severity: medium
Group by: "event.name", action, app, aws::recipientAccountId, login_challenge_method, src_ip, user
Author: Bhavin Patel, Mauricio Velazco, Splunk
Source: github.com/splunk/security_content

The following analytic identifies a successful single-factor authentication event against Google Cloud Platform (GCP) for an account without Multi-Factor Authentication (MFA) enabled. It uses Google Workspace login event data to detect instances where MFA is not utilized. This activity is significant as it may indicate a misconfiguration, policy violation, or potential account takeover attempt. If confirmed malicious, an attacker could gain unauthorized access to GCP resources, potentially leading to data breaches, service disruptions, or further exploitation within the cloud environment.

Known false positives

Although not recommended, certain users may be required without multi-factor authentication. Filter as needed

MITRE ATT&CK coverage

Tactic	Techniques
Resource Development	`T1586.003` Compromise Accounts: Cloud Accounts
Initial Access	`T1078.004` Valid Accounts: Cloud Accounts
Persistence	`T1078.004` Valid Accounts: Cloud Accounts
Privilege Escalation	`T1078.004` Valid Accounts: Cloud Accounts
Stealth	`T1078.004` Valid Accounts: Cloud Accounts

Telemetry coverage

Platform	Record / event type
Google Workspace	login_success: Login Success

Rules detecting the same action

These rules filter on the same operation.

Google Workspace Rapid Multi-IP Authentication (Panther)
Google Workspace Rapid Multi-IP Authentication (Panther)
Google Workspace Suspicious Login and Google Drive File Download (YARA-L)
Google Workspace Suspicious Login and Google Drive File Share (YARA-L)
Google Workspace User Login with Unusual ASN (Elastic)

Rule body

name: GCP Successful Single-Factor Authentication
id: 40e17d88-87da-414e-b253-8dc1e4f9555b
version: 13
creation_date: '2022-10-14'
modification_date: '2026-05-13'
author: Bhavin Patel, Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies a successful single-factor authentication event against Google Cloud Platform (GCP) for an account without Multi-Factor Authentication (MFA) enabled. It uses Google Workspace login event data to detect instances where MFA is not utilized. This activity is significant as it may indicate a misconfiguration, policy violation, or potential account takeover attempt. If confirmed malicious, an attacker could gain unauthorized access to GCP resources, potentially leading to data breaches, service disruptions, or further exploitation within the cloud environment.
data_source:
    - Google Workspace
search: |-
    `gws_reports_login` event.name=login_success NOT `gws_login_mfa_methods`
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY user, src_ip, login_challenge_method,
           app, event.name, vendor_account,
           action
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `gcp_successful_single_factor_authentication_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556) which allows Splunk administrators to collect Google Workspace event data in Splunk using Google Workspace APIs. Specifically, this analytic leverages the User log events.
known_false_positives: Although not recommended, certain users may be required without multi-factor authentication. Filter as needed
references:
    - https://attack.mitre.org/techniques/T1078/004/
    - https://support.google.com/a/answer/175197?hl=en
    - https://www.forbes.com/sites/daveywinder/2020/07/08/new-dark-web-audit-reveals-15-billion-stolen-logins-from-100000-breaches-passwords-hackers-cybercrime/?sh=69927b2a180f
finding:
    title: Successful authentication for user $user$ without MFA
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src_ip
      type: ip_address
analytic_story:
    - GCP Account Takeover
    - Scattered Lapsus$ Hunters
asset_type: Google Cloud Platform tenant
mitre_attack_id:
    - T1078.004
    - T1586.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

Stages and Predicates

Stage 1: `search`

`gws_reports_login` event.name=login_success NOT `gws_login_mfa_methods`

Stage 2: `stats`

| stats count min(_time) as firstTime max(_time) as lastTime
    BY user, src_ip, login_challenge_method,
       app, event.name, vendor_account,
       action

Stage 3: `search`

| `security_content_ctime(firstTime)`

Stage 4: `search`

| `security_content_ctime(lastTime)`

Stage 5: `search`

| `gcp_successful_single_factor_authentication_filter`

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`event.parameters{}.multiValue{}`	in	`"backup_code"`, `"google_authenticator"`, `"google_prompt"`, `"idv_any_phone"`, `"idv_preregistered_phone"`, `"internal_two_factor"`, `"knowledge_employee_id"`, `"knowledge_preregistered_email"`, `"knowledge_preregistered_phone"`, `"login_location"`, `"offline_otp"`, `"security_key"`, `"security_key_otp"`	`excludes:event.parameters{}.multiValue{}`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`event.name`	eq	`login_success`	`field:"event.name" kind:eq value:"login_success"`
`sourcetype`	eq	`gws:reports:login`	`field:"sourcetype" kind:eq value:"gws:reports:login"`