Rule Info
Name
Google Workspace Government Attack Warning
Author
Tom Kluter
Description
Detects a login attempt in Google Workspace flagged as a potential attack by a government-backed threat actor
Date
2026-04-28 00:00:00
Modified
None
Id
eafe6f2b-cfec-4612-aec2-49563c33a087
Tags
attack.privilege-escalation attack.persistence attack.initial-access attack.impact attack.stealth attack.t1078
Type
Community Rule
Link to Public Repo
Scan your endpoints, forensic images or collected files with our portable scanner THOR