Google Workspace login activity: Out-of-domain email forwarding

Flags Google Workspace out-of-domain email forwarding events from audit logs on login.googleapis.com.

FreeReviewedSigma · Medium · v4

Product: gcp
Service: google_workspace.login
Author: Tom kluter (SigmaHQ), DRL 1.1
Published: 2026-04-28
Updated: 2026-07-31

ATT&CK techniques

Collection

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
- T1114.003Email Forwarding Rule
C2
Exfiltration
Impact

What it detects

This rule flags Google Workspace events where email forwarding is automatically configured to send messages to domains outside the organization. Attackers can use this to exfiltrate data to accounts or services they control while keeping access within the email workflow. The detection relies on GCP/Google Workspace login activity telemetry that records the specific event name for out-of-domain email forwarding.

Reporting behind it

Related detections9 linkedT1114.003 — drag to rearrange

Suspicious Inbox Rule Creation With Forwarding or Deletion via M365 Exchange

Malicious Exchange Inbox Rule Hiding Workday Payroll Notifications via Payroll Pirate Compromise (via m365)

Malicious Mailbox Forwarding Rule Creation (via exchange)

Malicious Office 365 Email Forwarding Rule to External Domain (via office365)

Detect Email Forwarding/Redirecting via Exchange PowerShell InboxRule Cmdlets on Windows

Windows PowerShell: New-InboxRule/Set-InboxRule Script Block Activity

Microsoft 365 Audit Logs: Inbox Rule Creation or Update with Email Hiding Actions

O365 Mail Forwarding and Redirecting Rule Changes

Azure Risk Event: Suspicious Inbox Forwarding

Google Workspace login activity: Out-of-domain email forwarding

Pivot detection · T1114.003 · 9 related

Changelog

v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

gcp-google-workspace-login-email-forwarding-out-of-domain-activity-2a0bb2dd

title: "Google Workspace login activity: Out-of-domain email forwarding"
id: 8b61808f-20a8-44ad-80d9-c65b7bb62dcc
status: experimental
description: This rule flags Google Workspace events where email forwarding is automatically configured to send messages to domains outside the organization. Attackers can use this to exfiltrate data to accounts or services they control while keeping access within the email workflow. The detection relies on GCP/Google Workspace login activity telemetry that records the specific event name for out-of-domain email forwarding.
references:
  - https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#email_forwarding_out_of_domain
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/gworkspace/login/gcp_gworkspace_out_of_domain_email_forwarding.yml
author: Tom kluter, Huntrule Team
date: 2026-04-28
tags:
  - attack.t1114.003
  - attack.collection
logsource:
  product: gcp
  service: google_workspace.login
detection:
  selection:
    protoPayload.serviceName: login.googleapis.com
    protoPayload.metadata.event.eventName: email_forwarding_out_of_domain
  condition: selection
falsepositives:
  - Legitimate forwarding
level: medium
license: DRL-1.1
related:
  - id: 2a0bb2dd-eb5f-4517-8cb9-404f8ba764a5
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL