{"id":17171,"date":"2026-06-08T09:29:32","date_gmt":"2026-06-08T08:29:32","guid":{"rendered":"https:\/\/gatlabs.com\/knowledge\/?post_type=docs&p=17171"},"modified":"2026-06-08T13:12:30","modified_gmt":"2026-06-08T12:12:30","password":"","slug":"investigate-google-workspace-account-compromise-with-gat","status":"publish","type":"docs","link":"https:\/\/gatlabs.com\/knowledge\/tech-tips\/investigate-google-workspace-account-compromise-with-gat\/","title":{"rendered":"Investigate Google Workspace Account Compromise with GAT+"},"content":{"rendered":"

Introduction<\/h2>\n

When a Google Workspace account is suspected of being compromised, security teams must act quickly to determine the scope and impact of the breach.<\/span> While standard Google alerts provide basic notifications for unusual sign-ins, conducting a thorough forensic investigation requires deeper domain-wide visibility<\/p>\n

GAT+ serves as a powerful investigation tool, enabling administrators to trace malicious activity, perform blast-radius analysis, and answer critical incident-response questions. This article covers how to investigate an account compromise using GAT+ across four essential areas:<\/p>\n

    \n
  1. Pinpointing the first suspicious login<\/li>\n
  2. Determining the total duration of attacker access<\/li>\n
  3. Tracking key actions performed during the compromise<\/li>\n
  4. Identifying other users, files, or systems that may be affected<\/li>\n<\/ol>\n

    Pinpointing the First Suspicious Login<\/h2>\n

    Identifying the exact moment an attacker gained unauthorized access is crucial for establishing an incident timeline. Attackers often utilize compromised credentials from unexpected geographic locations or via known VPN\/proxy networks.<\/span><\/p>\n

    Navigate to GAT+ > Audit & Management > Users Logins<\/b>.<\/p>\n

    \u00a0\"User<\/p>\n

    Click the Apply custom filter<\/b> button to isolate anomalous activity:<\/p>\n