Suspicious Non-Browser Network Communication With Google API

Title: Suspicious Non-Browser Network Communication With Google API
Status: experimental
Description:Detects a non-browser process interacting with the Google API which could indicate the use of a covert C2 such as Google Sheet C2 (GC2-sheet)
References:
  -https://github.com/looCiprian/GC2-sheet
  -https://youtu.be/n2dFlSaBBKo
  -https://services.google.com/fh/files/blogs/gcat_threathorizons_full_apr2023.pdf
  -https://www.tanium.com/blog/apt41-deploys-google-gc2-for-attacks-cyber-threat-intelligence-roundup/
  -https://www.bleepingcomputer.com/news/security/hackers-abuse-google-command-and-control-red-team-tool-in-attacks/
Author: Gavin Knapp
Date: 2023-05-01
modified:2025-02-22
Tags:

• -'attack.command-and-control'
• -'attack.t1102'

Logsource:

• product: windows
• category: network_connection

Detection:
  selection:
    DestinationHostname|contains:
      -'drive.googleapis.com'
      -'oauth2.googleapis.com'
      -'sheets.googleapis.com'
      -'www.googleapis.com'

  filter_optional_brave:
    Image|endswith: '\brave.exe'
  filter_optional_chrome:
    Image|endswith:
      -':\Program Files\Google\Chrome\Application\chrome.exe'
      -':\Program Files (x86)\Google\Chrome\Application\chrome.exe'

  filter_optional_google_drive:
    Image|contains: ':\Program Files\Google\Drive File Stream\'
    Image|endswith: '\GoogleDriveFS.exe'
  filter_optional_firefox:
    Image|endswith:
      -':\Program Files\Mozilla Firefox\firefox.exe'
      -':\Program Files (x86)\Mozilla Firefox\firefox.exe'

  filter_optional_ie:
    Image|endswith:
      -':\Program Files (x86)\Internet Explorer\iexplore.exe'
      -':\Program Files\Internet Explorer\iexplore.exe'

  filter_optional_maxthon:
    Image|endswith: '\maxthon.exe'
  filter_optional_edge_1:
Image|contains:':\Program Files (x86)\Microsoft\EdgeWebView\Application\'     - Image|endswith:
      - ':\Program Files (x86)\Microsoft\Edge\Application\msedge.exe'
      - ':\Program Files\Microsoft\Edge\Application\msedge.exe'
      - '\WindowsApps\MicrosoftEdge.exe'
  filter_optional_edge_2:
    Image|contains:
      -':\Program Files (x86)\Microsoft\EdgeCore\'
      -':\Program Files\Microsoft\EdgeCore\'

    Image|endswith:
      -'\msedge.exe'
      -'\msedgewebview2.exe'

  filter_optional_opera:
    Image|endswith: '\opera.exe'
  filter_optional_safari:
    Image|endswith: '\safari.exe'
  filter_optional_seamonkey:
    Image|endswith: '\seamonkey.exe'
  filter_optional_vivaldi:
    Image|endswith: '\vivaldi.exe'
  filter_optional_whale:
    Image|endswith: '\whale.exe'
  filter_optional_googleupdate:
    Image|endswith: '\GoogleUpdate.exe'
  filter_optional_outlook_exe:
    Image|endswith: '\outlook.exe'
  filter_main_null:
    Image: 'None'
  filter_main_empty:
    Image: ''
  condition:selection and not 1 of filter_main_* and not 1 of filter_optional_*
Falsepositives:
  -Legitimate applications communicating with the "googleapis.com" endpoints that are not already in the exclusion list. This is environmental dependent and requires further testing and tuning.
Level: medium