Windows File Indicators for Goofy Guineapig Malware IOCS
Flags Windows file events involving specific Goofy Guineapig backdoor indicator filenames.
FreeReviewedSigma · High · v5
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-14
- Updated
- 2026-07-31
What it detects
This rule flags Windows file events that match specific Goofy Guineapig-related file paths and filenames. Attackers rely on consistent on-disk artifacts for staging and execution, making these indicator-based matches useful for quickly surfacing known compromise activity. It relies on file creation or modification telemetry that records the target filename on Windows.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-file-ioc-match-for-goofy-guineapig-backdoor-indicators-f0bafe60
title: Windows File Indicators for Goofy Guineapig Malware IOCS
id: ad228efb-aad5-44c6-a3d7-5243cd248f4c
status: test
description: This rule flags Windows file events that match specific Goofy Guineapig-related file paths and filenames. Attackers rely on consistent on-disk artifacts for staging and execution, making these indicator-based matches useful for quickly surfacing known compromise activity. It relies on file creation or modification telemetry that records the target filename on Windows.
references:
- https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/Goofy-Guineapig/file_event_win_malware_goofy_guineapig_file_indicators.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-14
tags:
- attack.execution
- detection.emerging-threats
- attack.stealth
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename:
- C:\ProgramData\GoogleUpdate\config.dat
- C:\ProgramData\GoogleUpdate\GoogleUpdate.exe
- C:\ProgramData\GoogleUpdate\GoogleUpdate\tmp.bat
- C:\ProgramData\GoogleUpdate\goopdate.dll
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: f0bafe60-1240-4798-9e60-4364b97e6bad
type: derived