GCP Google Workspace Login: Email Forwarding Out of Domain Activity

title: "GCP Google Workspace Login: Email Forwarding Out of Domain Activity"
id: 8b61808f-20a8-44ad-80d9-c65b7bb62dcc
status: experimental
description: This rule identifies Google Workspace login activity where the event indicates email forwarding to an external (out-of-domain) address. Attackers or insiders can use out-of-domain forwarding to exfiltrate emails or bypass mailbox access controls. It relies on Google Cloud audit telemetry from the login.googleapis.com service with the email_forwarding_out_of_domain event name in the event metadata.
references:
  - https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#email_forwarding_out_of_domain
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/gworkspace/login/gcp_gworkspace_out_of_domain_email_forwarding.yml
author: Tom kluter, Huntrule Team
date: 2026-04-28
tags:
  - attack.t1114.003
  - attack.collection
logsource:
  product: gcp
  service: google_workspace.login
detection:
  selection:
    protoPayload.serviceName: login.googleapis.com
    protoPayload.metadata.event.eventName: email_forwarding_out_of_domain
  condition: selection
falsepositives:
  - Legitimate forwarding
level: medium
license: DRL-1.1
related:
  - id: 2a0bb2dd-eb5f-4517-8cb9-404f8ba764a5
    type: derived