Skip to content
Workspace Forensics

This tool is not affiliated with, endorsed by or sponsored by Google LLC. Google Workspace, Gmail and Google Drive are trademarks of Google LLC. Other names are trademarks of their respective owners.

Glossary

External auto-forwarding

A mailbox setting or filter that automatically copies incoming mail to an address outside the organization.

External auto-forwarding sends a copy of incoming mail to an address outside the organization. In Gmail it can be set for all mail (auto-forwarding setting) or only for matching mail (a filter with a forward action). The destination must first be verified. Enabling it for an out-of-domain address is logged as email_forwarding_out_of_domain, with the destination.

For attackers it is persistence: they keep reading after losing the session. Admins can disable automatic forwarding for users in the Gmail End User Access settings. MITRE: T1114.003.

See: Gmail forwarding rules set by attackers.

This tool is not affiliated with, endorsed by or sponsored by Google LLC. Google Workspace, Gmail and Google Drive are trademarks of Google LLC. Other names are trademarks of their respective owners.