Suspicious Google Workspace Out Of Domain Email Forwarding (via google_workspace.login)

title: Suspicious Google Workspace Out Of Domain Email Forwarding (via google_workspace.login)
id: 0cfb0859-8d99-5c65-be25-9e34efa318ef
status: stable
description: This rule detects automatic email forwarding to external domains in Google Workspace, which may indicate data leakage or misuse.
references:
    - https://attack.mitre.org/techniques/T1114/003/
    - https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#email_forwarding_out_of_domain
author: Huntrule Team
date: 2026-06-13
tags:
    - attack.t1114.003
    - attack.collection
logsource:
    product: gcp
    service: google_workspace.login
detection:
    selection:
        protoPayload.serviceName: 'login.googleapis.com'
        protoPayload.metadata.event.eventName: 'email_forwarding_out_of_domain'
    condition: selection
falsepositives:
    - Unknown
level: medium