Google Workspace Brute Force or Credential Stuffing Attempt

Lacey Cochrane@NullVectorX

•updated Sep 1, 2026•1•0•7

Detects anomalous login activity in Google Workspace characterized by a high volume of login failures (5 or more) originating from a single IP address. The rule identifies potential brute force or credential stuffing campaigns and flags instances where a successful login occurs following a burst of failure events from the same source.