Rule Info
Name
Suspicious Login Activity Classified By Google
Author
Tom Kluter
Description
Detects Google Workspace login activity that's classified as suspicious by Google.
Date
2026-04-28 00:00:00
Modified
None
Id
38360161-76c4-4283-842e-efcf997dafc8
Tags
attack.initial-access attack.privilege-escalation attack.persistence attack.stealth attack.t1078.004
Type
Community Rule
Link to Public Repo
Scan your endpoints, forensic images or collected files with our portable scanner THOR