Potentially Suspicious GoogleUpdate Child Process
This rule detects the creation of suspicious child processes by 'GoogleUpdate.exe'. It specifically looks for any child process that is not a known legitimate Google-related executable (e.g., other GoogleUpdate components, GoogleCrashHandler, or specific setup/installer executables like 'setup.exe', 'chrome_updater.exe', 'chrome_installer.exe'). This behavior could indicate an attempt to leverage a legitimate Google process for malicious activity, such as defense evasion or persistence.
Sigma
