Using Gmail content compliance to quarantine Google Drive phishing

Gmail's content compliance rules can examine the headers and body of inbound mail and quarantine, reject, or modify what matches. A methodology for turning one preserved Drive-share phishing notification into a rule that catches the campaign without touching legitimate Drive notifications, and why there is no universal rule to copy.

The notifications are still arriving. You have removed the first wave from inboxes, told staff what to look for, and a second document with a new title has just been shared from a new account. You want something between "block Google" and "hope."

Gmail's content compliance rules are that something. This guide is a method for building one from a preserved sample, tuning it in quarantine, and only then letting it reject. It deliberately does not hand you a finished rule: a rule that matched every Drive-share phishing campaign would also match every legitimate Drive share, and a rule built on one campaign's specifics is yours to build.

The short answer

Content compliance can look inside the message. Google's rules can match on the subject, the body, the full headers, or headers and body together, with exact strings or regular expressions, and can then reject the message, quarantine it, or deliver it with modifications. It is available on Education Fundamentals, Standard and Plus.

Match on what is specific to the campaign, never on Google's sender. The sending address of every Drive notification is Google's. A rule that matches it catches every legitimate share in the district.

Quarantine first, reject later, if ever. Quarantined messages can be reviewed and released; rejected ones are gone. Move to rejection only after the rule has run clean on real traffic.

What a content compliance rule can see and do

Google's documentation describes three kinds of match. A simple content match looks for a string. An advanced content match lets you pick the location of the text and the match type, including regular expressions, with the string treated as an exact match. A metadata match works on message attributes rather than text. The advanced match locations Google lists are:

  • Headers and body: "the full headers plus the body. Includes attachments (MIME parts decoded)."
  • Full headers: "all header fields. Doesn't include the message body or attachments."
  • Body: the main text, including decoded attachments.
  • Subject, Sender header, and Recipients header.
  • Raw message: the undecoded message, equivalent to RFC 2822 bytes.

Google also notes that "both simple content and advanced content matches that apply to message body text will also apply to text extracted from attachments."

A rule applies to inbound, outbound, or internal messages as you choose, and when you add more than one expression you choose whether the message must match any of them or all of them. When it matches, Google's documented actions are: "Reject the message", "Quarantine the message", or "Deliver the message with modifications."

Quarantine is the setting that makes tuning safe. Google describes email quarantine as sending messages "to a quarantine before they're delivered to recipients", where "you and others in your organization can review them before they're delivered." Quarantined messages are kept for 30 days and then permanently deleted, so a review cadence matters.

The method

1. Capture a known sample

Take one notification you know to be malicious, complete with headers. The investigation guide covers preserving it; here you need the actual text, because the rule is built from what is literally in the message, not from what you remember of it. Save the raw source, not a screenshot.

2. Find the stable characteristics

Read the sample against a legitimate Drive notification from the same week. You are looking for what the campaign controls and what Google controls.

Google controls the sending address, the layout, the button text, and the boilerplate. Those are the same in the malicious message and in every real one, and they are useless to you.

The attacker controls the document title, the sharing account (and therefore its domain), the display name, and any text the sharer added to the share. The document title usually lands in the subject; the sharing account appears in the body. Those are your candidates.

3. Identify the campaign-specific indicators

From the candidates, pick the ones that are specific to this campaign and unlikely in legitimate mail:

  • The document title, or a distinctive fragment of it. Salary Schedule Update is specific. Schedule is not.
  • The sharing account's address, or its domain when the domain is one your users have no legitimate relationship with. A free-mail domain is not specific enough on its own; plenty of parents and vendors use one.
  • A destination domain that appears in the body when the sharer's note contains the link.

Write each one down as an exact string. Resist the urge to generalize yet.

4. Combine conditions

Prefer more than one independent, campaign-specific indicator. Build the rule so that it requires a Drive-share shape and a campaign-specific indicator. Using the all of the following option, for example:

  • Full headers contain the notification's characteristic subject fragment, shared a document with you or whatever your sample shows, so that the rule only ever considers Drive notifications; and
  • Headers and body contain the document title fragment from step 3; or, as a second rule, contain the sharing account's domain.

A fictional pairing that would have caught the example running through this cluster: full headers contain Salary Schedule Update, and body contains payroll.updates.k12@example.com. Both are attacker-chosen; neither appears in a legitimate share.

Regular expressions are available where the match type is Matches regex, and they are the right tool when a campaign varies a title by a number or a date. They are also the fastest way to over-match, so a regex that is not anchored to something campaign-specific should not leave quarantine.

5. Quarantine while you test

Set the action to Quarantine the message and scope the rule to inbound mail. If your Admin console offers it, scope it to the organizational units receiving the campaign rather than the whole domain. Google notes that Gmail quarantine changes "can take up to 24 hours but typically happen more quickly", so do not assume the rule is protecting anyone until you see matches in the quarantine. Then watch it for a day: every legitimate Drive notification that lands there is a false positive telling you which condition is too broad.

6. Review the false positives

Release anything legitimate, and note what it had in common with the sample. A rule that quarantines a teacher's rubric share because both messages contained the word Schedule needs a longer title fragment, not a different action.

7. Tighten the rule

Narrow the broad condition, or add a second required condition. Repeat the watch. A rule that has run for a school day, or through one full cycle of the kind of legitimate mail it might collide with, with nothing legitimate in quarantine is a rule you understand.

8. Move to rejection only when confidence is appropriate

Rejection returns the message to the sender and delivers nothing. For a campaign that has already been removed from inboxes and is still arriving, rejection of a well-tuned rule is defensible. For a rule you built an hour ago, it is not. You may choose to leave a campaign rule in quarantine for its whole life and retire it when the campaign stops; quarantine costs a daily review, and as long as someone does that review before the 30-day expiration it greatly reduces the chance of losing a legitimate message.

Why there is no universal rule

Every Drive notification shares a sender, a layout and a vocabulary, all of them Google's. A rule general enough to catch every malicious share must match on those, and then it matches every legitimate share too: Google's administrator help is explicit that Drive spam and phishing rides on notifications that "come from Google", and that is exactly why the sender is not a signal. The only reliable signals are the ones the attacker chooses, and the attacker chooses new ones for each campaign. A rule is therefore campaign-scoped by nature, and the skill worth having is building one quickly from a sample, not keeping a long list of dead ones.

What not to do

Do not match on Google's notification addresses or on google.com. That is a block on Google, with every consequence described in why blocking the sender doesn't stop Drive share phishing.

Do not start with reject. Quarantine is reversible; rejection is not, and your first rule will be wrong in some way you cannot see yet.

Do not match on one common word. Schedule, Evaluation, Payroll and Update all appear in legitimate share titles every week.

Do not forget the 30 days. Quarantined messages are deleted after 30 days; a rule nobody reviews is a rule that silently discards mail.

Do not treat the rule as the response. It stops the next notification; it does not remove the ones already delivered or the share itself. That is the remediation workflow.

Sources

A content compliance rule stops the next notification. The ones already delivered are the job of Message Removal in ORINEX Workspace Compliance, whose "block future mail" filter also matches on a phrase rather than the sender, for the same reason this guide does. What ORINEX Workspace does.