Google Workspace Out Of Domain Email Forwarding
Detects automatic email forwarding to external domains in Google Workspace, which may indicate data leakage or misuse.
Sigma rule (View on GitHub)
1title: Google Workspace Out Of Domain Email Forwarding
2id: 2a0bb2dd-eb5f-4517-8cb9-404f8ba764a5
3status: experimental
4description: Detects automatic email forwarding to external domains in Google Workspace, which may indicate data leakage or misuse.
5references:
6 - https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#email_forwarding_out_of_domain
7author: Tom kluter
8date: 2026-04-28
9tags:
10 - attack.t1114.003
11 - attack.collection
12logsource:
13 product: gcp
14 service: google_workspace.login
15detection:
16 selection:
17 protoPayload.serviceName: 'login.googleapis.com'
18 protoPayload.metadata.event.eventName: 'email_forwarding_out_of_domain'
19 condition: selection
20falsepositives:
21 - Legitimate forwarding
22level: medium
References
-
This document lists the events and parameters for various types of Login Audit activity events. You can retrieve these events by calling Activities.list() with applicationName=login. Login Audit ac...
Read More
Related rules
- Suspicious Inbox Forwarding Identity Protection
- Email Forwarding Rule - Suspicious Folders
- Email Forwarding Rule - Suspicious Forwarding Criteria
- Email Forwarding Rule - Suspicious Rule Names
- Github Delete Action Invoked