GWS Admin: 2SV Backup Code Generation
This rule detects the generation of 2-Step Verification (2SV) backup/scratch codes in Google Workspace. Backup codes allow a user to bypass standard MFA, making their generation a significant security event that may indicate an attacker is attempting to maintain persistent access to an account, often following a compromise or as a preparation for further malicious activity.
Sigma
