GA is a bad place to identify hack treats.
Look at your log files. Determine the following:
Is the client GET or POST to your page
What page are they posting to, and does this page pull any data from the DB (SQL injection), or show data back to the user(XSS).
Look at what the client is POSTING, look for input that would not be generated by your site, ie: &city= ’-- DELETE * FROM users’;
Ok simple example but you get the idea