Elastic high stable kql

Google Workspace Gmail Routing or Forwarding Rule Created or Modified

Detects when a Gmail routing, mail-forwarding, or custom mail-host setting is created or modified in Google Workspace. Adversaries with administrative access can add Routing rules (also deliver to / change envelope recipient), recipient address map forwarding, or mail hosts and outbound gateways to copy or redirect sensitive email for collection.

View Source

Detection Logic

data_stream.dataset:"google_workspace.admin" and event.action:(
  "CREATE_GMAIL_SETTING" or "CHANGE_GMAIL_SETTING"
  or "CREATE_APPLICATION_SETTING" or "CHANGE_APPLICATION_SETTING"
)
and (
  google_workspace.admin.setting.name:(
    "UNIFIED_MAIL_ROUTING"
    or "ALIAS_TABLE"
    or "EMAIL_ROUTE"
    or "MESSAGE_SECURITY_RULE"
  )
  or google_workspace.admin.setting.metadata.rule.type:(
    "UNIFIED_MAIL_ROUTING"
    or "ALIAS_TABLE"
    or "EMAIL_ROUTE"
  )
)

False Positives

⚠ Administrators may create or change Gmail routing, dual-delivery, address maps, or mail hosts for migrations, journaling, spam handling, or partner integrations.

Field Validations

Loading…

Comments (0)

Loading comments...