Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
4
Contributors
4
Categories
1
1
1
1
1
Platforms
3
1
Products / Services
1
1
1
1
1
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
Detects the creation of a Windows service named 'GoogleUpdate' with a specific ImagePath containing 'rundll32', 'FileProtocolHandler', and '\ProgramData\GoogleUpdate\GoogleUpdate.exe'. This pattern is associated with the Goofy Guineapig backdoor for persistence.
Detects the creation of specific files associated with the Goofy Guineapig malware, which attempts to impersonate Google Update components. The rule looks for 'config.dat', 'GoogleUpdate.exe', 'tmp.bat', and 'goopdate.dll' within the 'C:\ProgramData\GoogleUpdate\' directory.
This rule detects potential Command and Control (C2) communication associated with the Goofy Guineapig backdoor. It specifically looks for HTTP/S requests originating from a user agent string characteristic of the malware ('Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36') communicating with the domain 'static.tcplog.com'. This combination of user agent and destination domain is indicative of Goofy Guineapig C2 activity.
Detects "GoogleUpdate.exe" spawning a new instance of itself in an uncommon location, a technique used by the Goofy Guineapig backdoor to evade detection. The rule specifically looks for instances where both the parent and child process images are named 'GoogleUpdate.exe', but the child process is not located in standard Google installation or update paths.