{"id":"2a0bb2dd-eb5f-4517-8cb9-404f8ba764a5","title":"Google Workspace Out Of Domain Email Forwarding","description":"Detects automatic email forwarding to external domains in Google Workspace, which may indicate data leakage or misuse.","author":"Tom kluter","status":"experimental","level":"medium","date":"2026-04-28","modified":"","tags":["attack.t1114.003","attack.collection"],"technique_ids":["T1114.003"],"logsource":{"product":"gcp","service":"google_workspace.login"},"falsepositives":["Legitimate forwarding"],"references":["https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#email_forwarding_out_of_domain"],"source_path":"rules/cloud/gcp/gworkspace/login/gcp_gworkspace_out_of_domain_email_forwarding.yml","source_sha256":"e39e2f749b5650f0fdb186dc99d7da21a1abca29927496e0371529bdcfee5e88","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/gcp/gworkspace/login/gcp_gworkspace_out_of_domain_email_forwarding.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Google Workspace Out Of Domain Email Forwarding\nid: 2a0bb2dd-eb5f-4517-8cb9-404f8ba764a5\nstatus: experimental\ndescription: Detects automatic email forwarding to external domains in Google Workspace, which may indicate data leakage or misuse.\nreferences:\n    - https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#email_forwarding_out_of_domain\nauthor: Tom kluter\ndate: 2026-04-28\ntags:\n    - attack.t1114.003\n    - attack.collection\nlogsource:\n    product: gcp\n    service: google_workspace.login\ndetection:\n    selection:\n        protoPayload.serviceName: 'login.googleapis.com'\n        protoPayload.metadata.event.eventName: 'email_forwarding_out_of_domain'\n    condition: selection\nfalsepositives:\n    - Legitimate forwarding\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1114.003","id":"T1114.003","name":"Email Forwarding Rule","page":"techniques/enterprise/T1114.003/"}],"data_path":"data/detection-rules/2a0bb2dd-eb5f-4517-8cb9-404f8ba764a5.json","kind":"sigma"}