Windows File IOC Match for Goofy Guineapig Backdoor Indicators

title: Windows File IOC Match for Goofy Guineapig Backdoor Indicators
id: ad228efb-aad5-44c6-a3d7-5243cd248f4c
status: test
description: This rule identifies file activity that matches specific indicators associated with the Goofy Guineapig malware on Windows. Attackers may use these files for persistence and execution under a masqueraded path. The detection relies on Windows file event telemetry that captures TargetFilename values observed in the monitored environment.
references:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/Goofy-Guineapig/file_event_win_malware_goofy_guineapig_file_indicators.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-14
tags:
  - attack.execution
  - detection.emerging-threats
  - attack.stealth
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename:
      - C:\ProgramData\GoogleUpdate\config.dat
      - C:\ProgramData\GoogleUpdate\GoogleUpdate.exe
      - C:\ProgramData\GoogleUpdate\GoogleUpdate\tmp.bat
      - C:\ProgramData\GoogleUpdate\goopdate.dll
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: f0bafe60-1240-4798-9e60-4364b97e6bad
    type: derived