Google Workspace playbooks #

Playbooks for Google Workspace (Gmail, Drive) incidents. Expand a playbook for step-by-step actions; adapt the order to the environment and the rules of engagement, and record each step in your notes as you go. All playbooks.

Playbook - suspected BEC in Google Workspace (Gmail)
  1. Money first: bank recall and FBI IC3 as for M365, in parallel with everything below.
  2. Preserve: export audit logs for the window - Login, Admin, Gmail, Token (OAuth) and SAML - via the Reports API or GAM. Most are kept about 6 months, but Email Log Search covers only 30 days, so pull message logs first. Place a Vault hold on the user's Gmail and Drive if the edition includes Vault.
  3. Sign-ins: Login audit events (login_success, suspicious_login, login_challenge, 2-Step Verification changes) - new IPs, ASNs and user agents, and any Google alert such as a suspicious-login or government-backed-attack warning. If SSO is in front of Google, the identity provider's logs (Okta / Entra) are the real sign-in record.
  4. Mailbox manipulation: dump the user's Gmail settings read-only (Gmail API or GAM): filters (users.settings.filters), forwarding addresses and auto-forwarding, delegates (users.settings.delegates) and send-as aliases (users.settings.sendAs). Attacker filters typically skip the inbox, mark read or delete mail about payments.
  5. Third-party access: Token audit events for OAuth apps granted Gmail or Drive scopes in the window; app passwords created; recovery email / phone changed.
  6. Downstream: Email Log Search for everything the user sent in the window and its recipients; Gmail log events for message activity (6 months). Look for replies to look-alike domains and changed bank details.
  7. Contain: reset the password and sign the user out (Admin console, ends web sessions and revokes sign-in cookies); revoke OAuth tokens and app passwords; remove attacker filters, forwarding, delegates and send-as aliases; re-enrol 2SV with a security key; consider disabling external automatic forwarding for the organization.
  8. Report with ATT&CK (T1566.002, T1078.004, T1114.003, T1564.008, T1534, T1528), impact assessment and remediation. See Google Workspace.