Gsuite Outbound Email With Attachment To External Domain

Status: production
Group by: dest_domain, phase, severity
Author: Teoderick Contreras, Stanislav Miskovic, Splunk
Source: github.com/splunk/security_content

The following analytic detects outbound emails with attachments sent from an internal email domain to an external domain. It leverages Gsuite Gmail logs, parsing the source and destination email domains, and flags emails with fewer than 20 outbound instances. This activity is significant as it may indicate potential data exfiltration or insider threats. If confirmed malicious, an attacker could use this method to exfiltrate sensitive information, leading to data breaches and compliance violations.

MITRE ATT&CK coverage

Tactic	Techniques
Exfiltration	`T1048.003` Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol

Rule body splunk

name: Gsuite Outbound Email With Attachment To External Domain
id: dc4dc3a8-ff54-11eb-8bf7-acde48001122
version: 9
creation_date: '2021-08-17'
modification_date: '2026-05-13'
author: Teoderick Contreras, Stanislav Miskovic, Splunk
status: production
type: Hunting
description: The following analytic detects outbound emails with attachments sent from an internal email domain to an external domain. It leverages Gsuite Gmail logs, parsing the source and destination email domains, and flags emails with fewer than 20 outbound instances. This activity is significant as it may indicate potential data exfiltration or insider threats. If confirmed malicious, an attacker could use this method to exfiltrate sensitive information, leading to data breaches and compliance violations.
data_source:
    - G Suite Gmail
search: |-
    `gsuite_gmail` num_message_attachments > 0
      | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)"
      | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)"
      | where source_domain="internal_test_email.com" and not dest_domain="internal_test_email.com"
      | eval phase="plan"
      | eval severity="low"
      | stats values(subject) as subject, values(source.from_header_address) as src_domain_list, count as numEvents, dc(source.from_header_address) as numSrcAddresses, min(_time) as firstTime max(_time) as lastTime
        BY dest_domain phase severity
      | where numSrcAddresses < 20
      | sort - numSrcAddresses
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `gsuite_outbound_email_with_attachment_to_external_domain_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
known_false_positives: network admin and normal user may send this file attachment as part of their day to day work. having a good protocol in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack.
references:
    - https://www.redhat.com/en/topics/devops/what-is-devsecops
analytic_story:
    - Dev Sec Ops
    - Insider Threat
asset_type: GSuite
mitre_attack_id:
    - T1048.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: endpoint
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_outbound_email_to_external/gsuite_external_domain.log
          source: http:gsuite
          sourcetype: gsuite:gmail:bigquery
      test_type: unit

Stages and Predicates

Stage 1: `search`

`gsuite_gmail` num_message_attachments > 0

Stage 2: `rex`

| rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)"

Stage 3: `rex`

| rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)"

Stage 4: `where`

| where source_domain="internal_test_email.com" and not dest_domain="internal_test_email.com"

Stage 5: `eval`

| eval phase="plan"

Stage 6: `eval`

| eval severity="low"

Stage 7: `stats`

| stats values(subject) as subject, values(source.from_header_address) as src_domain_list, count as numEvents, dc(source.from_header_address) as numSrcAddresses, min(_time) as firstTime max(_time) as lastTime
    BY dest_domain phase severity

Stage 8: `where`

| where numSrcAddresses < 20

Stage 9: `sort`

| sort - numSrcAddresses

Stage 10: `search`

| `security_content_ctime(firstTime)`

Stage 11: `search`

| `security_content_ctime(lastTime)`

Stage 12: `search`

| `gsuite_outbound_email_with_attachment_to_external_domain_filter`

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

Field	Kind	Excluded values
`dest_domain`	eq	`"internal_test_email.com"`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`numSrcAddresses`	lt	`20`
`num_message_attachments`	gt	`0`
`source_domain`	eq	`"internal_test_email.com"`
`sourcetype`	eq	`gsuite:gmail:bigquery`

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Gsuite Outbound Email With Attachment To External Domain

MITRE ATT&CK coverage

Rule body splunk

Stages and Predicates

Stage 1: `search`

Stage 2: `rex`

Stage 3: `rex`

Stage 4: `where`

Stage 5: `eval`

Stage 6: `eval`

Stage 7: `stats`

Stage 8: `where`

Stage 9: `sort`

Stage 10: `search`

Stage 11: `search`

Stage 12: `search`

Exclusions

Indicators

Keyboard shortcuts

Search operators

Gsuite Outbound Email With Attachment To External Domain

MITRE ATT&CK coverage

Rule body splunk

Stages and Predicates

Stage 1: search

Stage 2: rex

Stage 3: rex

Stage 4: where

Stage 5: eval

Stage 6: eval

Stage 7: stats

Stage 8: where

Stage 9: sort

Stage 10: search

Stage 11: search

Stage 12: search

Exclusions

Indicators

Stage 1: `search`

Stage 2: `rex`

Stage 3: `rex`

Stage 4: `where`

Stage 5: `eval`

Stage 6: `eval`

Stage 7: `stats`

Stage 8: `where`

Stage 9: `sort`

Stage 10: `search`

Stage 11: `search`

Stage 12: `search`