Sagan informational stable other

[GCP] *Critical and Call* Email Forwarding Outside Domain

[GCP] *Critical and Call* Email Forwarding Outside Domain

View Source

Detection Logic

alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[GCP] *Critical and Call* Email Forwarding Outside Domain"; content: "cloudaudit.googleapis.com"; content: "google.login.LoginService.emailForwardingOutOfDomain"; flexbits:set,GCP_Event,10; classtype: system-event; parse_src_ip: 1; sid: 5006018; rev:2;)

Field Validations

Loading…

Comments (0)

Loading comments...