Elastic Security Detection Rules

Google Workspace Gmail Routing or Forwarding Rule Created or Modified

Last updated 23 days ago on 2026-07-08
Created 4 years ago on 2022-09-13

About

Detects when a Gmail routing, mail-forwarding, or custom mail-host setting is created or modified in Google Workspace. Adversaries with administrative access can add Routing rules (also deliver to / change envelope recipient), recipient address map forwarding, or mail hosts and outbound gateways to copy or redirect sensitive email for collection.
Tags
Domain: CloudData Source: Google WorkspaceTactic: CollectionLanguage: kuery
Severity
high
Risk Score
73
MITRE ATT&CK™

Collection (TA0009)(external, opens in a new tab or window)

↳ Email Collection (T1114)(external, opens in a new tab or window)

False Positive Examples
Administrators may create or change Gmail routing, dual-delivery, address maps, or mail hosts for migrations, journaling, spam handling, or partner integrations.
License
Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type
Query (Kibana Query Language)
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
logs-google_workspace.admin-*
Related Integrations

google_workspace(external, opens in a new tab or window)

Query
text code block:
data_stream.dataset:"google_workspace.admin" and event.action:(
  "CREATE_GMAIL_SETTING" or "CHANGE_GMAIL_SETTING"
  or "CREATE_APPLICATION_SETTING" or "CHANGE_APPLICATION_SETTING"
)
and (
  google_workspace.admin.setting.name:(
    "UNIFIED_MAIL_ROUTING"
    or "ALIAS_TABLE"
    or "EMAIL_ROUTE"
    or "MESSAGE_SECURITY_RULE"
  )
  or google_workspace.admin.setting.metadata.rule.type:(
    "UNIFIED_MAIL_ROUTING"
    or "ALIAS_TABLE"
    or "EMAIL_ROUTE"
  )
)

Install detection rules in Elastic Security

Detect Google Workspace Gmail Routing or Forwarding Rule Created or Modified in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).