Goofy Guineapig Backdoor Service Creation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•22

Detects the creation of a Windows service named 'GoogleUpdate' with a specific ImagePath containing 'rundll32', 'FileProtocolHandler', and '\ProgramData\GoogleUpdate\GoogleUpdate.exe'. This pattern is associated with the Goofy Guineapig backdoor for persistence.