Google Workspace suspicious login
Google Workspace flagged a login as suspicious (Google's own risk engine set is_suspicious=true, or a suspicious_login / out-of-domain…
What it detects
Google Workspace flagged a login as suspicious (Google's own risk engine set is_suspicious=true, or a suspicious_login / out-of-domain login-challenge event fired). This is Google's native account-risk signal and is a useful early indicator of credential compromise.
MITRE ATT&CK mapping
- T1078Valid Accounts· Defense Evasion
False positives and triage
Google's suspicious-login heuristic can flag legitimate travel or a new device. Correlate with the source IP/country, whether the user completed a challenge, and any follow-on mailbox or sharing activity.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 65%. Source: rules/cloud/gws_suspicious_login.yaml, licensed under the Apache License 2.0.
id: cloud.gws.suspicious_login
version: 1.0.0
status: stable
severity: medium
confidence: 0.65
platforms: [application]
mitre_techniques: [T1078]
description: |
Google Workspace flagged a login as suspicious (Google's own risk engine set
`is_suspicious=true`, or a `suspicious_login` / out-of-domain login-challenge event
fired). This is Google's native account-risk signal and is a useful early indicator of
credential compromise.
match:
provider: GoogleWorkspace
raw_message_contains_any:
- "is_suspicious=true"
- "suspicious_login"
- "suspicious_login_less_secure_app"
- "account_disabled_spamming"
correlation_keys: [user_name]
false_positive_guidance: |
Google's suspicious-login heuristic can flag legitimate travel or a new device.
Correlate with the source IP/country, whether the user completed a challenge, and any
follow-on mailbox or sharing activity.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.