A mail forwarding rule was configured in Google Workspace

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	2 Days
Required Data	Google Workspace Audit Logs
Detection Modules	Identity Threat Module, SaaS Threat Detection
Detector Tags	Google Workspace
ATT&CK Tactic	Collection (TA0009), Exfiltration (TA0010)
ATT&CK Technique	Email Collection: Email Forwarding Rule (T1114.003), Automated Exfiltration (T1020), Email Collection (T1114)
Severity	Medium

Description

A rule was set up to forward emails outside the Google Workspace domain.

Attacker's Goals

• Adversaries may abuse email forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim's organization to use as part of further exploits or operations.
• Furthermore, email forwarding rules can allow adversaries to maintain persistent access to victim's emails even after compromised credentials are reset by administrators.

Investigative actions

• Check if the identity intended to preform this action, * and look for signs that the user account and mailbox are compromised (e.g. abnormal logins, unusual activity).
• Check if the forwarding domain is an unknown external domain and look up its reputation.
• Follow further actions done by the account.

Variations

A mail forwarding rule was configured in Google Workspace to an uncommon domain

Synopsis

Field	Value
ATT&CK Tactic	Collection (TA0009), Exfiltration (TA0010)
ATT&CK Technique	Email Collection: Email Forwarding Rule (T1114.003), Automated Exfiltration (T1020), Email Collection (T1114)
Severity	High

Description

A rule was set up to forward emails outside the Google Workspace domain.

Attacker's Goals

• Adversaries may abuse email forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim's organization to use as part of further exploits or operations.
• Furthermore, email forwarding rules can allow adversaries to maintain persistent access to victim's emails even after compromised credentials are reset by administrators.

Investigative actions

• Check if the identity intended to preform this action, * and look for signs that the user account and mailbox are compromised (e.g. abnormal logins, unusual activity).
• Check if the forwarding domain is an unknown external domain and look up its reputation.
• Follow further actions done by the account.