Detection of Google Workspace Suspicious Login Events

Google Workspace maintains audit logs that categorize specific login activities as suspicious based on Google's internal heuristics. These events, reported via the 'login.googleapis.com' service within GCP/Workspace audit logs, flag sign-in attempts that deviate from established patterns or violate security policies. Specifically, the system identifies three primary categories: standard suspicious logins, usage of less secure applications, and anomalous programmatic login patterns. Monitoring these audit events is critical for detecting potential account takeover, credential harvesting, or automated abuse by malicious actors targeting corporate identities. Defenders should ingest these audit logs to identify compromised accounts, unauthorized third-party integrations, and automated exploitation of service accounts.

Impact

Successful exploitation of account credentials or programmatic interfaces can lead to unauthorized data exfiltration, persistent access to organizational resources, and the use of the corporate environment as a platform for further lateral movement or phishing campaigns.

Recommendation

1. Configure GCP Admin Audit logs to export 'login.googleapis.com' event data to a centralized SIEM or security data lake.
2. Deploy the Sigma detection rule below to flag and alert on 'suspicious_login', 'suspicious_login_less_secure_app', and 'suspicious_programmatic_login' event names.
3. Perform regular reviews of flagged accounts to distinguish between malicious activity and misconfigured but legitimate legacy applications.