Detailed Tips for Investigating a Google Account Compromise

This information is intended to assist with investigation and mitigation for a compromised organization Google account. Note: More investigation beyond the steps in this document may be necessary to determine the full extent of the event, including whether or not any other accounts were compromised or data was breached. In addition, following the organization’s incident response plan, if appropriate, is recommended.

Questions to consider:

How did this incident start?

When did this start?

What happened?

Which accounts were compromised (all accounts)?

What other files/data were accessed?

What other SSO systems were accessed?

What other email messages were viewed/deleted/etc.?

What passwords could be compromised via Google password manager?

What can be changed to prevent this from happening in the future?

Immediate First Steps (Containment)

In the Google Admin Console, within the Users section

Reset Password for the user

Within Security tab:

Click on Sign-in Cookies and click Reset

Connected applications and devices; click on the edit pencil and then delete (trash can) next to each application

Suspend the user account as needed, during investigation

Additional Investigation

Accessing Google Investigation Search:

Education Plus Version: Log into Google Admin console, Security, Investigation Tool

Google Workspace Free Version: Go to Audit and Investigation page in the Admin console.

Who clicked the link:

Gmail message filter

For user sender is choose the phish sender’s account

Recipient is and choose an account who received the message

Find a copy of the email that was sent, then copy that email subject

New search: Attribute subject is and paste the subject of the email sent

Then deleted all the emails that were sent internally (Education Plus, only)

Then check gmail log events

Event is choose: link click

Subject contains [subject of the email sent]

For any user who appears in this search, force password change.

Checked the login events for each of the users that had clicked the link

When/Where/IP that logged into compromised account(s):

Go back to the original user account that is now disabled

Choose user log events

Event is choose: successful login

User contains: enter compromised user’s account

Check the IP addresses of the log in events, ruled out the building IP and user’s home network IP. Compromised IP address may say “is suspicious” is true and country of origin may be different than the US.

Find date and time of the compromise then check the user’s emails from then and prior to find any prior suspicious messages.

Once find root cause email, check for other users who clicked the link in the root cause message

Note: original email compromise may have been occurred days/weeks prior to the latest email messages going out from the organization.

Did malicious IP use Google Takeout to mass-export?

Look at Takeout log events

Choose IP address contains [malicious IP]

Look at Single Sign On events (Were other systems accessed via SSO?)

Look at SAML log events
Choose IP address contains [malicious IP]
Choose Actor contains; choose the compromised account

Were contacts exported?

Look at Contacts log events

For Actor contains choose the compromised account

Verify that contacts were exported (consider what information was exported—example: home phone numbers, addresses, etc.)

Check for Google Drive log events

These are only available for so long; check as soon as you know an account was compromised. IP address contains; choose the compromised IP address

This will show documents that were shared, deleted, viewed, edited

What other email messages were accessed, forwarded, deleted?

These are only available for so long; check as soon as you know an account was compromised.

Gmail log events=> IP address contains choose the compromised IP Address

Check what email was accessed, forwarded, deleted

Additional User log events

Choose User log events
User contains choose the compromised account

Other Systems

If the user stores passwords in Google or uses single sign-on for other systems, also check logs for those systems to see when the user’s account accessed the system/data.

Notifying Other Organizations

If the phishing attempt originated from a compromised valid account, call or email the originating organization’s IT department or main phone number.

If your organization’s compromised user emailed external contacts, notify those contacts or their technical support. In the notification, include:

Sender

Email subject

Other confirmed and relevant information about the email such as details of what happens if the user clicks the link/opens attachment

For notifications to technical support, obfuscate (change) any reference to malicious links, so the links don’t resolve. (Example: replace “https” with “hxxp” and add brackets “[.]” around dots in the link.)

Include the advice that any user who clicked link/interacted with the email message should notify their technical support.

If applicable, advise recipients to:

Revoke all sign-in cookies/sessions

After revoking, change password

Notes:

Avoid advising whether or not recipients should delete the email message.

Avoid statements regarding data being compromised or not compromised unless advised by legal counsel.

Additional Mitigation and Protection

Ensure all organization devices are up to date on operating system and browser versions.

Consider re-imaging/wiping and re-installing Windows for any device where the user opened a malicious attachment or potentially interacted with malware via a link click.

Ensure email spoofing is prevented, if you have not already set up DMARC/DKIM/SPF:

Email Spoofing

Google Set up DMARC

Google Set up DKIM

Google Set up SPF

Set limits on max recipients by OU.

Establish data region where Google data is stored (example: US-based servers, only)

Enable advanced phishing and malware protections

Enable Google Vault (data retention and incident investigation)

Tuned role-based access (in addition to User and Super Admin, see the other the various administrator access types)

Implement Data Loss Prevention rules– to alert for accidental sharing of data such as banking information, credit card information, social security numbers, etc.

Additional settings to consider: