Google Workspace Indirect Prompt Injection (IPI) — Detection and Defense Guide

---
title: Google Workspace Gemini - Suspicious Document Access Pattern
id: a8b4c3d2-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects Gemini accessing documents shortly after sharing, potential IPI preparation
references:
  - https://attack.mitre.org/techniques/T1566/
  - http://security.googleblog.com/2026/04/google-workspaces-continuous-approach.html
author: Security Arsenal
date: 2026/04/15
tags:
  - attack.initial_access
  - attack.t1566
logsource:
  product: google_workspace
  service: drive
detection:
  selection:
    actor.email|re: '.*\\@external-domain\\.com'
    name.event: 'access'
  filter:
    actor.email|re: '.*@(yourdomain\\.com|trusted-partner\\.com)'
  timeframe: 1h
  condition: selection and not filter
falsepositives:
  - Legitimate external document access via Gemini
level: medium
---
title: Google Workspace - Unusual Gemini API Call Volume
id: b9c5d4e3-2f6a-5b7c-0d9e-1f2a3b4c5d6e
status: experimental
description: Detects abnormal spike in Gemini API calls, possible IPI exploitation attempts
references:
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/04/15
tags:
  - attack.valid_accounts
  - attack.t1078
logsource:
  product: google_workspace
  service: token
detection:
  selection:
    application_name: 'Gemini API'
  timeframe: 15m
  condition: selection | count() > 50
falsepositives:
  - High-volume legitimate AI batch processing
level: high
---
title: Google Workspace Gemini - Data Exfiltration via Email
id: c0d6e5f4-3g7b-6c8d-1e0f-2g3h4i5j6k7l
status: experimental
description: Detects Gemini sending emails with large attachments, potential IPI data exfiltration
references:
  - https://attack.mitre.org/techniques/T1567/
author: Security Arsenal
date: 2026/04/15
tags:
  - attack.exfiltration
  - attack.t1567
logsource:
  product: google_workspace
  service: gmail
detection:
  selection:
    actor.email|re: '.*@.*\\.gemini\\..*'
    event_name: 'message_send'
  filter:
    attachment_size|lt: 1000000
  condition: selection and not filter
falsepositives:
  - Legitimate Gemini-generated reports via email
level: high

// KQL for Microsoft Sentinel - Monitor Google Workspace via CEF/Syslog
// Detect potential Indirect Prompt Injection patterns

// Rule 1: Gemini accessing multiple documents from different owners rapidly
let GeminiDocumentAccess = 
Syslog
| where Facility == "google_workspace"
| where ProcessName == "drive"
| extend EventData = parse_(SyslogMessage)
| where EventData.event_name == "access" 
| where EventData.actor.email contains "gemini"
| project TimeGenerated, DocumentId = EventData.doc_id, ActorEmail = EventData.actor.email, OwnerEmail = EventData.doc_owner_email, DocumentTitle = EventData.doc_title
| summarize count() by bin(TimeGenerated, 5m), OwnerEmail, ActorEmail
| where count_ > 10
| project TimeGenerated, OwnerEmail, ActorEmail, AccessCount = count_
| order by TimeGenerated desc;
GeminiDocumentAccess

// Rule 2: Unusual data transfer patterns from Gemini sessions
let GeminiDataTransfer = 
CommonSecurityLog
| where DeviceVendor == "Google"
| where DeviceProduct == "Workspace"
| where AdditionalExtensions contains "gemini"
| parse kv DeviceCustomString1 with *"bytes_transferred"* BytesTransferred:int *"destination"* Destination:string *
| where isnotempty(BytesTransferred)
| summarize TotalBytes = sum(BytesTransferred) by bin(TimeGenerated, 1h), SourceIP, Destination
| where TotalBytes > 10485760  // > 10MB
| project TimeGenerated, SourceIP, Destination, TotalBytes
| order by TimeGenerated desc;
GeminiDataTransfer

// Rule 3: Cross-workspace data access via Gemini (potential IPI pivot)
let CrossWorkspaceAccess = 
Syslog
| where Facility == "google_workspace"
| extend EventData = parse_(SyslogMessage)
| where EventData.actor.email contains "gemini"
| where EventData.event_name == "access"
| extend ActorDomain = split(EventData.actor.email, "@")[1], OwnerDomain = split(EventData.doc_owner_email, "@")[1]
| where ActorDomain != OwnerDomain
| project TimeGenerated, ActorEmail = EventData.actor.email, OwnerEmail = EventData.doc_owner_email, ActorDomain, OwnerDomain, DocumentId = EventData.doc_id
| order by TimeGenerated desc;
CrossWorkspaceAccess

-- Velociraptor VQL for hunting IPI indicators on endpoints with Google Workspace sync
-- Hunt for suspicious documents containing potential IPI payloads

-- Rule 1: Identify documents with hidden text or suspicious metadata
SELECT FullPath, Size, Mtime, Btime
FROM glob(globs='*/Downloads/*.doc*', root=pathspec(args={"path": ["/Users/*/Downloads", "C:\Users\*\Downloads"]}))
WHERE Size > 0 AND Size < 102400  -- Focus on small docs often used in IPI

-- Rule 2: Find recently modified Google Drive synced files with content suggesting IPI
SELECT FullPath, Size, Mtime, data
FROM glob(globs='*/Google Drive/*.gdoc', root=pathspec(args={"path": ["/Users/*/Google Drive", "C:\Users\*\Google Drive"]}))
WHERE read_file(filename=FullPath, length=1000) =~ "(ignore|override|system|instruction|prompt)" 
  AND read_file(filename=FullPath, length=1000) =~ "(previous|above|context)"

-- Rule 3: Check for unusual network connections from Workspace sync tools
SELECT PID, ProcessName, RemoteAddr, RemotePort, State
FROM netstat(pid=pid)
WHERE ProcessName =~ "(googledrive|backupandsync|drivefs)"
  AND RemotePort NOT IN (443, 80)
  AND State =~ "(ESTABLISHED|SYN_SENT)"

# PowerShell script to audit Google Workspace Gemini configuration for IPI hardening
# Requires Google Cloud SDK and Workspace Admin privileges

# Check Gemini API access controls
function Get-GeminiAPIConfiguration {
    param (
        [string]$OrganizationId
    )
    
    $result = gcloud organizations list --format= | ConvertFrom-Json
    Write-Host "[+] Checking Gemini API configuration for organization: $OrganizationId"
    
    # Get IAM policies for Gemini API
    $iamPolicy = gcloud services enable aiplatform.googleapis.com --project=$OrganizationId 2>&1
    if ($LASTEXITCODE -eq 0) {
        Write-Host "[!] Gemini API is enabled - verify access controls" -ForegroundColor Yellow
    }
    
    # Check for overly permissive bindings
    $bindings = gcloud projects get-iam-policy $OrganizationId --format= | ConvertFrom-Json
    foreach ($binding in $bindings.bindings) {
        if ($binding.role -like "*gemini*" -or $binding.role -like "*aiplatform*") {
            Write-Host "[+] Role: $($binding.role)" -ForegroundColor Cyan
            foreach ($member in $binding.members) {
                Write-Host "    Member: $member"
            }
        }
    }
}

# Audit Workspace data access scopes
function Get-WorkspaceDataAccessAudit {
    param (
        [string]$AdminEmail,
        [string]$Domain
    )
    
    Write-Host "[+] Retrieving Workspace access audit logs for suspicious Gemini activity"
    # This would typically use GAM or Admin SDK API
    Write-Host "[INFO] Use GAM: gam audit create drive " -ForegroundColor Gray
    Write-Host "[INFO] Or use Reports API: reports.activities().list(userKey='all', applicationName='drive', eventName='access')" -ForegroundColor Gray
}

# Main execution
Write-Host "[*] Google Workspace IPI Hardening Audit" -ForegroundColor Green
Write-Host "[*] " (Get-Date -Format "yyyy-MM-dd HH:mm:ss")

# Check for required modules
$requiredModules = @("GoogleCloud", "PSGoogle")
foreach ($module in $requiredModules) {
    if (-not (Get-Module -ListAvailable -Name $module)) {
        Write-Host "[!] Required module '$module' not found. Install with: Install-Module $module" -ForegroundColor Red
    }
}

# Run configuration checks
$orgId = Read-Host "Enter Google Cloud Organization ID"
Get-GeminiAPIConfiguration -OrganizationId $orgId

Write-Host "[*] Audit complete. Review findings and apply least-privilege access controls." -ForegroundColor Green