gmail spike in undeliverables

Severity: medium
Type: alert
Time window: 10m
Match by: user
Author: Bastradamus
Source: github.com/chronicle/detection-rules

Detects a spike in undeliverable emails, this can be an early indication of a targeted phishing campaign or a compromised user account.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1566` Phishing

Rules detecting the same action

These rules filter on the same operation.

Gmail Malicious SMTP Response (Panther)
Gmail Potential Spoofed Email Delivered (Panther)
Gsuite Attachments Downloaded from Spam Email (Panther)
Gsuite Email Bypassed Spam Filter (Panther)
Gsuite Link Clicked in Spam Email (Panther)
Malware Detected in Email (Panther)
Spam Email Surge (Panther)

Rule body

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

rule gmail_spike_in_undeliverables {

  meta:
    author = "Bastradamus"
    description = "Detects a spike in undeliverable emails, this can be an early indication of a targeted phishing campaign or a compromised user account."
    severity = "Medium"
    priority = "Medium"
    type = "alert"
    platform = "Google workspace"
    data_source = "Workspace Activity, gmail"
    mitre_attack_tactic = "Initial Access"
    mitre_attack_technique = "Phishing"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1566/"

  events:
    $email.metadata.vendor_name = "Google Workspace"
    $email.metadata.product_name = "gmail"
    $email.metadata.event_type = "EMAIL_TRANSACTION"
    $email.network.email.subject = /Undeliverable\:/ nocase
    $email.target.user.email_addresses = $user
    $email.network.email.subject = $subject

  match:
    $user over 10m

  outcome:
    $mitre_attack_tactic = array_distinct("Initial Access")
    $mitre_attack_technique = array_distinct("Phishing")
    $mitre_attack_technique_id = array_distinct("T1566")
    $event_count = count_distinct($email.metadata.description)
    $target_user_distinct_count = count_distinct($user)
    $target_user_count = count($user)
    $principal_ip = array_distinct($email.principal.ip)
    $count_subject_bounce = count_distinct($subject)
    $count_bounce_distinct_mail_id = count_distinct($email.network.email.mail_id)
    $sender_from = array_distinct($email.principal.network.email.from)

  condition:
    $email and $count_bounce_distinct_mail_id > 10 and $count_subject_bounce = 1
}

YARA-L rule structure

Condition

Fires when at least one $email event in the 10m window and $count_bounce_distinct_mail_id > 10 and $count_subject_bounce = 1.

Events

`$email` `EMAIL_TRANSACTION`

network.email.subject matches "Undeliverable\:"

Match and correlation

Match key: $user (target.user.email_addresses)
Within: 10m

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

Field	Expression
`event_count`	`count_distinct($email.metadata.description)`
`target_user_distinct_count`	`count_distinct($user)`
`target_user_count`	`count($user)`
`principal_ip`	`array_distinct($email.principal.ip)`
`count_subject_bounce`	`count_distinct($subject)`
`count_bounce_distinct_mail_id`	`count_distinct($email.network.email.mail_id)`
`sender_from`	`array_distinct($email.principal.network.email.from)`