GRIDTIDE C2 Communication via Google Sheets API
Detects non-browser processes making outbound connections to specific Google Sheets API endpoints used by the GRIDTIDE backdoor for command and control. This activity is indicative of the malware using legitimate cloud services to disguise its C2 traffic.
Microsoft Sentinel (KQL)
