Detection rules › Panther
Gsuite Mail forwarded to external domain
A user has configured mail forwarding to an external domain
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Collection | T1114 Email Collection |
Rule body yaml
AnalysisType: rule
Filename: gsuite_external_forwarding.py
RuleID: "GSuite.ExternalMailForwarding"
DisplayName: "Gsuite Mail forwarded to external domain"
Enabled: true
LogTypes:
- GSuite.ActivityEvent
Tags:
- GSuite
- Collection:Email Collection
Reports:
MITRE ATT&CK:
- TA0009:T1114
Severity: Medium
Description: >
A user has configured mail forwarding to an external domain
Reference: https://support.google.com/mail/answer/10957?hl=en&sjid=864417124752637253-EU
Runbook: >
Follow up with user to remove this forwarding rule if not allowed.
SummaryAttributes:
- p_any_emails
Tests:
- Name: Forwarding to External Address - applicationName = user_accounts
ExpectedResult: true
Log:
{
"id": { "applicationName": "user_accounts", "customerId": "D12345" },
"actor": { "email": "homer.simpson@.springfield.io" },
"type": "email_forwarding_change",
"name": "email_forwarding_out_of_domain",
"parameters":
{ "email_forwarding_destination_address": "HSimpson@gmail.com" },
}
- Name: Forwarding to External Address - applicationName = login
ExpectedResult: true
Log:
{
"id": { "applicationName": "login", "customerId": "D12345" },
"actor": { "email": "homer.simpson@springfield.io" },
"type": "email_forwarding_change",
"name": "email_forwarding_out_of_domain",
"parameters": { "email_forwarding_destination_address": "HSimpsone@gmail.com" }
}
- Name: Non Forwarding Event
ExpectedResult: false
Log:
{
"id": { "applicationName": "user_accounts", "customerId": "D12345" },
"actor": { "email": "homer.simpson@.springfield.io" },
"type": "2sv_change",
"name": "2sv_enroll",
}
- Name: ListObject Type
ExpectedResult: false
Log:
{
"actor":
{ "email": "user@example.io", "profileId": "118111111111111111111" },
"id":
{
"applicationName": "drive",
"customerId": "D12345",
"time": "2022-12-20 17:27:47.080000000",
"uniqueQualifier": "-7312729053723258069",
},
"ipAddress": "12.12.12.12",
"kind": "admin#reports#activity",
"name": "rename",
"parameters":
{
"actor_is_collaborator_account": null,
"billable": true,
"doc_id": "1GGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGG",
"doc_title": "Document Title- Found Here",
"doc_type": "presentation",
"is_encrypted": null,
"new_value": ["Document Title- Found Here"],
"old_value": ["Document Title- Old"],
"owner": "user@example.io",
"owner_is_shared_drive": null,
"owner_is_team_drive": null,
"primary_event": true,
"visibility": "private",
},
"type": "access",
}
Detection logic
Condition
id.applicationName in ["user_accounts", "login"]
name eq "email_forwarding_out_of_domain"
This rule also runs imperative logic the parser cannot express as a filter; the conditions above are the structured part it could extract.
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
id.applicationName | in |
|
name | eq |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
email | actor.email |
email_forwarding_destination_address | parameters.email_forwarding_destination_address |