Google Workspace External Email Forwarding Rule
Detects the creation of email forwarding rules in Google Workspace that direct emails to external domains. This activity can indicate potential Business Email Compromise (BEC) for persistence or insider data exfiltration.
Cortex XDR
