{"id":"7e9cf7b6-e827-11ed-a05b-0242ac120003","title":"Suspicious Non-Browser Network Communication With Google API","description":"Detects a non-browser process interacting with the Google API which could indicate the use of a covert C2 such as Google Sheet C2 (GC2-sheet)\n","author":"Gavin Knapp","status":"experimental","level":"medium","date":"2023-05-01","modified":"2025-02-22","tags":["attack.command-and-control","attack.t1102"],"technique_ids":["T1102"],"logsource":{"product":"windows","category":"network_connection"},"falsepositives":["Legitimate applications communicating with the \"googleapis.com\" endpoints that are not already in the exclusion list. This is environmental dependent and requires further testing and tuning."],"references":["https://github.com/looCiprian/GC2-sheet","https://youtu.be/n2dFlSaBBKo","https://services.google.com/fh/files/blogs/gcat_threathorizons_full_apr2023.pdf","https://www.tanium.com/blog/apt41-deploys-google-gc2-for-attacks-cyber-threat-intelligence-roundup/","https://www.bleepingcomputer.com/news/security/hackers-abuse-google-command-and-control-red-team-tool-in-attacks/"],"source_path":"rules/windows/network_connection/net_connection_win_domain_google_api_non_browser_access.yml","source_sha256":"492381dfda004b4130d72eb1c5deb240f1fa2ba6ba2e32a40ce8c2bef4e7531a","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/network_connection/net_connection_win_domain_google_api_non_browser_access.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Non-Browser Network Communication With Google API\nid: 7e9cf7b6-e827-11ed-a05b-0242ac120003\nstatus: experimental\ndescription: |\n    Detects a non-browser process interacting with the Google API which could indicate the use of a covert C2 such as Google Sheet C2 (GC2-sheet)\nreferences:\n    - https://github.com/looCiprian/GC2-sheet\n    - https://youtu.be/n2dFlSaBBKo\n    - https://services.google.com/fh/files/blogs/gcat_threathorizons_full_apr2023.pdf\n    - https://www.tanium.com/blog/apt41-deploys-google-gc2-for-attacks-cyber-threat-intelligence-roundup/\n    - https://www.bleepingcomputer.com/news/security/hackers-abuse-google-command-and-control-red-team-tool-in-attacks/\nauthor: Gavin Knapp\ndate: 2023-05-01\nmodified: 2025-02-22\ntags:\n    - attack.command-and-control\n    - attack.t1102\nlogsource:\n    product: windows\n    category: network_connection\ndetection:\n    selection:\n        DestinationHostname|contains:\n            # Note: Please add additional google API related domains that might be abused.\n            - 'drive.googleapis.com'\n            - 'oauth2.googleapis.com'\n            - 'sheets.googleapis.com'\n            - 'www.googleapis.com'\n    filter_optional_brave:\n        Image|endswith: '\\brave.exe'\n    filter_optional_chrome:\n        Image|endswith:\n            - ':\\Program Files\\Google\\Chrome\\Application\\chrome.exe'\n            - ':\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe'\n    filter_optional_google_drive:\n        Image|contains: ':\\Program Files\\Google\\Drive File Stream\\'\n        Image|endswith: '\\GoogleDriveFS.exe'\n    filter_optional_firefox:\n        Image|endswith:\n            - ':\\Program Files\\Mozilla Firefox\\firefox.exe'\n            - ':\\Program Files (x86)\\Mozilla Firefox\\firefox.exe'\n    filter_optional_ie:\n        Image|endswith:\n            - ':\\Program Files (x86)\\Internet Explorer\\iexplore.exe'\n            - ':\\Program Files\\Internet Explorer\\iexplore.exe'\n    filter_optional_maxthon:\n        Image|endswith: '\\maxthon.exe'\n    filter_optional_edge_1:\n        - Image|contains: ':\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\'\n        - Image|endswith:\n              - ':\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe'\n              - ':\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe'\n              - '\\WindowsApps\\MicrosoftEdge.exe'\n    filter_optional_edge_2:\n        Image|contains:\n            - ':\\Program Files (x86)\\Microsoft\\EdgeCore\\'\n            - ':\\Program Files\\Microsoft\\EdgeCore\\'\n        Image|endswith:\n            - '\\msedge.exe'\n            - '\\msedgewebview2.exe'\n    filter_optional_opera:\n        Image|endswith: '\\opera.exe'\n    filter_optional_safari:\n        Image|endswith: '\\safari.exe'\n    filter_optional_seamonkey:\n        Image|endswith: '\\seamonkey.exe'\n    filter_optional_vivaldi:\n        Image|endswith: '\\vivaldi.exe'\n    filter_optional_whale:\n        Image|endswith: '\\whale.exe'\n    filter_optional_googleupdate:\n        Image|endswith: '\\GoogleUpdate.exe'\n    filter_optional_outlook_exe:\n        Image|endswith: '\\outlook.exe'\n    filter_main_null:\n        Image: null\n    filter_main_empty:\n        Image: ''\n    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Legitimate applications communicating with the \"googleapis.com\" endpoints that are not already in the exclusion list. This is environmental dependent and requires further testing and tuning.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1102","id":"T1102","name":"Web Service","page":"techniques/enterprise/T1102/"}],"data_path":"data/detection-rules/7e9cf7b6-e827-11ed-a05b-0242ac120003.json","kind":"sigma"}