GWS Admin: Email Persistence
This rule detects the creation of email monitors or mail routing destinations within Google Workspace. These actions are indicative of persistent access methods where an attacker redirects or copies sensitive emails to an external or attacker-controlled account, enabling long-term intelligence gathering.
Sigma
