Sigma medium experimental sigma

Google Workspace Out Of Domain Email Forwarding

Detects automatic email forwarding to external domains in Google Workspace, which may indicate data leakage or misuse.

View Source

Detection Logic

{
  "selection": {
    "protoPayload.serviceName": "login.googleapis.com",
    "protoPayload.metadata.event.eventName": "email_forwarding_out_of_domain"
  },
  "condition": "selection"
}

False Positives

  • ⚠ Legitimate forwarding

Field Validations

Loading…

Comments (0)

Loading comments...