Potential Goofy Guineapig GoolgeUpdate Process Anomaly

Status: test
Severity: high
Log source: category process_creation, product windows
Author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects "GoogleUpdate.exe" spawning a new instance of itself in an uncommon location as seen used by the Goofy Guineapig backdoor

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	No specific technique

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Potential Goofy Guineapig GoolgeUpdate Process Anomaly
id: bdbab15a-3826-48fa-a1b7-723cd8f32fcc
status: test
description: Detects "GoogleUpdate.exe" spawning a new instance of itself in an uncommon location as seen used by the Goofy Guineapig backdoor
references:
    - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf
author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-15
tags:
    - detection.emerging-threats
    - attack.stealth
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\GoogleUpdate.exe'
        Image|endswith: '\GoogleUpdate.exe'
    filter_main_legit_paths:
        - Image|startswith:
              - 'C:\Program Files\Google\'
              - 'C:\Program Files (x86)\Google\'
        - Image|contains: '\AppData\Local\Google\Update\'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_*

Stage 1: `selection`

selection:
    ParentImage|endswith: '\GoogleUpdate.exe'
    Image|endswith: '\GoogleUpdate.exe'

Stage 2: `not filter_main_legit_paths`

filter_main_legit_paths:
    - Image|startswith:
          - 'C:\Program Files\Google\'
          - 'C:\Program Files (x86)\Google\'
    - Image|contains: '\AppData\Local\Google\Update\'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Image`	match	`\AppData\Local\Google\Update\`	`excludes:Image` `field:"Image" value:"\AppData\Local\Google\Update\"`
`Image`	starts_with	`C:\Program Files (x86)\Google\`	`excludes:Image` `field:"Image" value:"C:\Program Files (x86)\Google\"`
`Image`	starts_with	`C:\Program Files\Google\`	`excludes:Image` `field:"Image" value:"C:\Program Files\Google\"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\GoogleUpdate.exe`	`field:"Image" kind:ends_with value:"\GoogleUpdate.exe"`
`ParentImage`	ends_with	`\GoogleUpdate.exe` corpus 3 (sigma 3)	`field:"ParentImage" kind:ends_with value:"\GoogleUpdate.exe"`