Suspicious Non-Browser Network Communication With Google API

SigmaHQ Detections@sigmaHQ

•updated Feb 22, 2025•0•13

Detects a non-browser process interacting with the Google API which could indicate the use of a covert C2 such as Google Sheet C2 (GC2-sheet). The rule specifically looks for connections to Google API domains from processes that are not common web browsers or Google-related applications, aiming to identify potentially malicious command and control activity.