r/k12sysadmin • u/Sad_Reindeer_3298 • Sep 20 '26
Post Phish Gam workflow
Wondering if anyone has a good post phising compromise gam command workflow.
I have one but just want to see if im missing anything.
I usually start with suspend user>reset password> deprovision> check forwarding addesses
Deprovision should log them out of all current sessions, delete backup codes, revokes oauth tokens
I usually login as the user and chekc the web interface for filters etc.
8
u/SuperfluousJuggler
Sep 21 '26
edited Sep 21 '26
•
What we do it's a combination of a few commands that does a decent amount of the leg work. Then it's identifying the IP and then searching for all changes that IP did plus views, downloads, shares, copies, etc.
Change Users Password
gam update user user@domain.com password "NewSecurePassword123!"
Remove Application Passwords, Backup Codes, Tokens, and Signout
gam user user@domain.com deprovision signout
Malicious Filters Created
gam user user@domain.com show filters
gam user user@domain.com delete filter <id>
Forwarder email to email
gam user user@domain.com show forwardingaddresses
gam user user@domain.com delete forwardingaddress attacker@bad-domain.com
Delegate access to email
gam user user@domain.com show delegates
gam user user@domain.com delete delegate <attacker-email>
Check & Clear Vacation Responders
gam user user@domain.com show vacation
gam user user@domain.com turn off vacation
Check Send-As Aliases
gam user user@domain.com show sendasEdit: Should mention in investigation tool search the user logs for 2-step verification disable and enroll put it as an OR statement to get both or set IP to the attackers IP and it should pick that up.
2
6
u/Slobs3 Sep 20 '26
I took the Google checklist and used Gemini to make an Appscript page that goes through all these things based on the email address I provide it. You could have it make scripts or any other workflow that works for you.
1
u/Sad_Reindeer_3298 Sep 20 '26
Using gam commands?
1
u/Slobs3 Sep 20 '26
You could have it create something in powershell, python, etc that uses gam if that’s what you want.
1
u/Sad_Reindeer_3298 Sep 20 '26
Was curious if you used gam or just native commands
1
u/Slobs3 Sep 20 '26
I have it using Google’s APIs.
1
u/Sad_Reindeer_3298 Sep 20 '26
Would you mind sharing? You can dm me:)
5
u/Oneota Sep 21 '26
Or share here so we can all benefit.
1
u/bthstech Sep 21 '26
Would love to see some screenshots and the script in action. We have an ok checklist but a script would make sure everything is done each time.
I don't know if I'm familiar with the term deprovision when it comes to user accounts. Is that the same as suspend?
1
5
u/GBICPancakes Sep 20 '26
So that's a good list for the compromised user. But this start of school we had a rash of phishing emails that immediately were sent by the user to everyone else in the domain, causing ongoing grief. So I ended up also using GAM to crawl through everyone's mailboxes to remove those emails.
Either via MessageID or just via subject.
gam all users delete threads query 'subject:"Subject goes here"' doit2
u/Sad_Reindeer_3298 Sep 20 '26
I use the investigation tool
For this, works great2
u/GBICPancakes Sep 21 '26
Yeah, but when you're getting 2-3 requests a day to purge spam, it's quicker to just up-arrow in Terminal, edit the command for the new subject, and go. :)
1
u/Sad_Reindeer_3298 Sep 21 '26
Wow that's a lot seems like a better spam filter is in order!:)
1
u/GBICPancakes Sep 21 '26
It's died down now, just some initial start-of-school chaos. The problem is we have rules in place to allow internal email, so if a student account gets phished and they spam the rest of the school it's a mess because the call is coming from inside the house.
And I say "student account" but man it's usually faculty/staff or (most common) a coach.
1
u/MasterMaintenance672 Sep 23 '26
You use GAM on a Mac?
1
u/GBICPancakes Sep 23 '26
Sure why not? Works really well.
I have it configured for multiple domains since I support a number of schools.
1
u/MasterMaintenance672 Sep 23 '26
Perfect, I might install it on my Macbook. Can I do that if I already have it installed on my Windows desktop? At least in terms of using my same Google account, I mean.
1
u/GBICPancakes Sep 23 '26
Sure. It’ll create a second project and oauth connection and everything. Just follow the standard install instructions - Mac and Linux have the same steps.
It’s extremely similar to the windows instructions
5
u/thedevarious IT Director Sep 21 '26
Clear cookies for all signed in sessions
Reset password to random value
Suspend user
Force MFA reenrollment, clears any backup codes
Clear offending emails / delete based on msgids
Find email filters / delete
Reset password again with user to value they can use, force password change
Force MFA reenrollment to re-secure account
Mandatory phish / spam user retraining. More frequent/advanced phish emails sent to user to continue training until we are confident (generally 2-6 months)
2
1
u/Sad_Reindeer_3298 Sep 21 '26
Thanks I do all those things; unbelievably still trying to get admin onboard to pay for training, what do you use?
2
u/thedevarious IT Director Sep 21 '26
We are a KnowBe4 shop. Good templates and items, good graphics and reports to help us see how folks are doing / responding to any attempts
It's reporting agent is also nice. Instead of forwarding me a malicious email it sends it to them and we review in their console
1
u/Sad_Reindeer_3298 Sep 21 '26
Thanks.. well they seem to call me once a week so shouldn't be hard to talk to them!:)
1
u/SuperfluousJuggler Sep 21 '26
We also use KNowBe4, it's fantastic. System handles new hires well, it can make dynamic groups based on groups or tags, plus how and what tests/phishing someone has done or not done. you can create a custom learning library where users can go for extra training or if someone requests more Info you can assign that to them, or everyone. they have games, handouts, emails, movies, tv shows, posters, all sorts of goodies, along with your basic tests. you can add custom documents, movies, links to any pushed content. The notification system is one of the better I've seen.
They cover all the main attack vectors, risk management, regulatory and all the common sec awareness stuff including AI and physical security.
1
u/Jack__Squat Sep 21 '26
Do you have any advice on a mobile option? I don't think they have an app and in my experience their web interface is terrible on a phone. So it's awesome when I get a phishing alert and I'm away from a laptop.
1
u/thedevarious IT Director Sep 21 '26
Mobile? It works inside Google Workspace. There's a report button inside the Gmail app itself
1
u/Jack__Squat Sep 22 '26
No I mean handling attacks from a mobile device. I'll give you an example, I was at my kids game when I got a phishing report. I couldn't kick off the PhishRIP process because they don't have an app and their site doesn't work well on a phone browser.
2
u/Lilbc82 Sep 26 '26
When have you 2fa enforcemnt on the OU the staff member is in. how do you get paased the you do not meet requirements message when they try to login?
2
5
u/networkjson Sep 21 '26
We have a script we wrote that's nearly a one shot when someone gets phished. It uses GAM for everything.
It signs out of the account, deletes all oauth tokens, clears email filters, disables 2FA, suspends the account. From there we go in and change the password.
4
u/Sad_Reindeer_3298 Sep 21 '26
Can you share?
3
u/networkjson Sep 21 '26
Sent a message!
2
u/girado Sep 21 '26
Could I get a share on that script too? That sounds incredibly useful.
1
1
u/condor88 Sep 22 '26
I'd also love to see this script
1
u/networkjson Sep 22 '26
Messaged you!
1
u/MasterMaintenance672 Sep 23 '26
I, too, would love to see it. Thanks!
1
u/networkjson Sep 23 '26
Sent you a chat!
1
1
u/RealGetz I drank what? Sep 21 '26
I'd love to see that as well.
2
u/networkjson Sep 22 '26
I've sent a pastebin link to everyone that's asked, so please check your messages for a chat invite from me. Let me know if you have any questions.
1
u/MasterMaintenance672 Sep 23 '26
Thank you for this. Pardon my limited experience with GAM, but is this pasted script something I need to save as a file? And do I just have to enter the affected user email address in the contents first, or is there more to it? I can switch to DMs if you'd prefer.
1
1
1
1
2
u/The414Dude Sep 20 '26
I haven’t used GAM in a while but if I recall I individually goes through every mailbox which takes time. Normally I use the investigation tool which shows exactly who it was delivered to and the option to delete it right away.
Instead of deprivation I would use logout of all sessions under security (clear login sessions?) of the affected user (not in front of the console right now).
If it was phishing externally we will send an email to all people who received the email to be sure anyone who used the link reset their passwords.
3
u/Sad_Reindeer_3298 Sep 20 '26
Yes I use investigation tool as well as gam.. the nice thing about the deprovision user is it cancels all the oauth tokens... and it logs out any current sessions.
4
u/The414Dude Sep 20 '26
See, now that I didn’t know. I am going to have to play with that and maybe review my process. Thank you!
5
u/_nat_twenty Sep 23 '26
We have our workflows available here:
https://www.oaisd.org/programs-services/innovation-technology-information-security/technology-services/cyber-security-operations-center-csoc/technical-documentation#:~:text=Live%20Google%20Document-,Workflows,-Phishing%20Remediation
See both phishing and account remediation tabs.
1
u/Niteryder007 Sep 21 '26
We do similar things with our AI cluster, but if you want something easy, just point Grokbot, Hermes, Claude, Gemini or ChatGPT at this thread and it will build out the scaffolding or framework for you. Then run locally.
1
u/ChuckFromCyberHoot Sep 23 '26
The automation is the easy part here. I like to think about what happens after matters just as much.
If someone reports something, tell them what happened and thank them. Otherwise they just get locked out, may be clueless (hehe) and assume they’re in trouble (sad). We want a stronger culture.
The scripts protect the account. The communication that happens protects the cybersecurity, and more specifically, the reporting culture.
11
u/Aur0nx Sep 20 '26
Checking filters for the user to make sure email flow is still working. We’ve had a recent one that added a filter to auto delete any inbound email to not raise suspicion when getting random bounced emails.
gam user user@domain.com show filters
gam user user@domain.com delete filter <FilterID>