Techniques
Sample rules
Google Workspace Out Of Domain Email Forwarding
- source: sigma
- technicques:
- t1114
- t1114.003
Description
Detects automatic email forwarding to external domains in Google Workspace, which may indicate data leakage or misuse.
Detection logic
condition: selection
selection:
protoPayload.metadata.event.eventName: email_forwarding_out_of_domain
protoPayload.serviceName: login.googleapis.com