Query: Sigma rule for Detects a non-browser process interacting with the Google API which could indicate the use of a covert C2 such as Google
Matching passage: Sigma rule: Detects a non-browser process interacting with the Google API which could indicate the use of a covert C2 such as Google. Logsource: windows / network_connection. Rule: title: Suspicious Non-Browser Network Communication With Google API id: 7e9cf7b6-e827-11ed-a05b-0242ac120003 status: experimental description: 'Detects a non-browser process interacting with the Google API which could indicate the use of a covert C2 such as Google Sheet C2 (GC2-sheet) ' references: - https://github.com/looCiprian/GC2-sheet - https://youtu.be/n2dFlSaBBKo - https://services.google.com/fh/files/blogs/gcat_threathorizons_full_apr2023.pdf - https://www.tanium.com/blog/apt41-deploys-google-gc2-for-attacks-cyber-threat-intelligence-roundup/ - https://www.bleepingcomputer.com/news/security/hackers-abuse-google-command-and-control-red-team-tool-in-attacks/ author: Gavin Knapp date: 2023-05-01 modified: 2025-02-22 tags: - attack.command-and-control - attack.t1102 logsource: product: windows category: network_connection detection: selection: DestinationHostname|contains: - drive.googleapis.com - oauth2.googleapis.com - sheets.googleapis.com - www.googleapis.com filter_optional_brave: Image|endswith: \brave.exe filter_optional_chrome: Image|endswith: - :\Program Files\Google\Chrome\Application\chrome.exe - :\Program Files (x86)\Google\Chrome\Application\chrome.exe filter_optional_google_drive: Image|contains: :\Program Files\Google\Drive File Stream\ Image|endswith: \GoogleDriveFS.exe filter_optional_firefox: Image|endswith: - :\Program Files\Mozilla Firefox\firefox.exe - :\Program Files (x86)\Mozilla Firefox\firefox.exe filter_optional_ie: Image|endswith: - :\Program Files (x86)\Internet Explorer\iexplore.exe - :\Program Files\Internet Explorer\iexplore.exe filter_optional_maxthon: Image|endswith: \maxthon.exe filter_optional_edge_1: - Image|contains: :\Program Files (x86)\Microsoft\EdgeWebView\Application\ - Image|endswith: - :\Program Files (x86)\Microsoft\Edge\Application\msedge.exe - :\Program Files\Microsoft\Edge\Application\msedge.exe - \WindowsApps\MicrosoftEdge.exe filter_optional_edge_2: Image|contains: - :\Program Files (x86)\Microsoft\EdgeCore\ - :\Program Files\Microsoft\EdgeCore\ Image|endswith: - \msedge.exe - \msedgewebview2.exe filter_optional_opera: Image|endswith: \opera.exe filter_optional_safari: Image|endswith: \safari.exe filter_optional_seamonkey: Image|endswith: \seamonkey.exe filter_optional_vivaldi: Image|endswith: \vivaldi.exe filter_optional_whale: Image|endswith: \whale.exe filter_optional_googleupdate: Image|endswith: \GoogleUpdate.exe filter_optional_outlook_exe: Image|endswith: \outlook.exe filter_main_null: Image: nul
Near-miss passage: Sigma rule: Detects the execution of "whoami.exe" by privileged accounts that are often abused by threat actors. Logsource: windows / process_creation. Rule: title: Whoami.EXE Execution From Privileged Process id: 79ce34ca-af29-4d0e-b832-fc1b377020db related: - id: 80167ada-7a12-41ed-b8e9-aa47195c66a1 type: obsolete status: test description: Detects the execution of "whoami.exe" by privileged accounts that are often abused by threat actors references: - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment - https://web.archive.org/web/20221019044836/https://nsudo.m2team.org/en-us/ author: Florian Roth (Nextron Systems), Teymur Kheirkhabarov date: 2022-01-28 modified: 2023-12-04 tags: - attack.privilege-escalation - attack.discovery - attack.t1033 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: whoami.exe - Image|endswith: \whoami.exe selection_user: User|contains: - AUTHORI - AUTORI - TrustedInstaller condition: all of selection_* falsepositives: - Unknown level: high