administrators may create or change gmail routing, dual-delivery, address maps, or mail hosts for migrations, journaling, spam handling, or partner integrations.

t1114
google_workspace
elastic

Techniques

T1114

Sample rules

Google Workspace Gmail Routing or Forwarding Rule Created or Modified

source: elastic
technicques:
- T1114

Description

Detects when a Gmail routing, mail-forwarding, or custom mail-host setting is created or modified in Google Workspace. Adversaries with administrative access can add Routing rules (also deliver to / change envelope recipient), recipient address map forwarding, or mail hosts and outbound gateways to copy or redirect sensitive email for collection.

Detection logic

data_stream.dataset:"google_workspace.admin" and event.action:(
  "CREATE_GMAIL_SETTING" or "CHANGE_GMAIL_SETTING"
  or "CREATE_APPLICATION_SETTING" or "CHANGE_APPLICATION_SETTING"
)
and (
  google_workspace.admin.setting.name:(
    "UNIFIED_MAIL_ROUTING"
    or "ALIAS_TABLE"
    or "EMAIL_ROUTE"
    or "MESSAGE_SECURITY_RULE"
  )
  or google_workspace.admin.setting.metadata.rule.type:(
    "UNIFIED_MAIL_ROUTING"
    or "ALIAS_TABLE"
    or "EMAIL_ROUTE"
  )
)