admin.setting[.]nameDomain

Reported by 1 independent source · first reported 3 Jan 2023 by Elastic Security Labs · last reported 3 Jan 2023

Last reported 3 years ago

What the reports say

1 report, newest first · the exact sentence from each

“…event.dataset: google_workspace.admin and event.action: "CREATE_GMAIL_SETTING" and not related.user: terrance and google_workspace.admin.setting[.]name: (MESSAGE_SECURITY_RULE or EMAIL_ROUTE)”

Elastic Security LabsVendor3 Jan 2023
Google Workspace Attack Surface

named in the same reports

Copy these 2 indicators · defanged

2 indicators, defanged, one per line

dejesusarcheology[.]com
hxxps://www.googleapis[.]com/auth/admin.reports.audit.readonly

Thanks — we review every report.

Report a wrong value