Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionmediumexperimental

Google Workspace Out Of Domain Email Forwarding

Detects automatic email forwarding to external domains in Google Workspace, which may indicate data leakage or misuse.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Tom kluterCreated Tue Apr 282a0bb2dd-eb5f-4517-8cb9-404f8ba764a5cloud
Log Source
Google Cloudgoogle_workspace.login
ProductGoogle Cloud← raw: gcp
Servicegoogle_workspace.login← raw: google_workspace.login
Detection Logic
Detection Logic1 selector
detection:
    selection:
        protoPayload.serviceName: 'login.googleapis.com'
        protoPayload.metadata.event.eventName: 'email_forwarding_out_of_domain'
    condition: selection
False Positives

Legitimate forwarding

References
1
Resolving title…
developers.google.com
MITRE ATT&CK
Rule Metadata
Rule ID
2a0bb2dd-eb5f-4517-8cb9-404f8ba764a5
Status
experimental
Level
medium
Type
Detection
Created
Tue Apr 28
Author
Tom kluter
Path
rules/cloud/gcp/gworkspace/login/gcp_gworkspace_out_of_domain_email_forwarding.yml
Raw Tags
attack.t1114.003attack.collection
View on GitHub