GCP OS Login Command Execution on Instance

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects HTTP POST requests to the GCP OS Login API endpoint 'oslogin.googleapis.com'. Such requests could indicate an attempt to execute commands on a Google Cloud instance using the OS Login feature, which is a common method for managing SSH access to instances.