Google Workspace Out Of Domain Email Forwarding

experimentalmedium
log source: gcp · google_workspace.loginauthor Tom kluterdate 2026-04-28
01

description

What this is, in brief.

Detects automatic email forwarding to external domains in Google Workspace, which may indicate data leakage or misuse.

02

tags

attack.t1114.003attack.collection
03

rule source (YAML)

title: Google Workspace Out Of Domain Email Forwarding
id: 2a0bb2dd-eb5f-4517-8cb9-404f8ba764a5
status: experimental
description: Detects automatic email forwarding to external domains in Google Workspace, which may indicate data leakage or misuse.
references:
    - https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#email_forwarding_out_of_domain
author: Tom kluter
date: 2026-04-28
tags:
    - attack.t1114.003
    - attack.collection
logsource:
    product: gcp
    service: google_workspace.login
detection:
    selection:
        protoPayload.serviceName: 'login.googleapis.com'
        protoPayload.metadata.event.eventName: 'email_forwarding_out_of_domain'
    condition: selection
falsepositives:
    - Legitimate forwarding
level: medium
04

detects techniques (1)

ATT&CK techniques this enables or maps to.

05

references

External citations — patches, advisories, analysis.