Windows Non-Browser Network Traffic to Google APIs

title: Windows Non-Browser Network Traffic to Google APIs
id: 60e7bcc1-edb3-4588-b399-eaa7e1746591
status: experimental
description: This rule flags network connections from a non-browser process to Google API endpoints (drive.googleapis.com, oauth2.googleapis.com, sheets.googleapis.com, www.googleapis.com). Attackers may use legitimate cloud services as covert command-and-control infrastructure, blending C2 traffic into normal API access patterns. Detection relies on Windows network connection telemetry including destination hostname and the connecting process image path, with exclusions for common browsers and related software.
references:
  - https://github.com/looCiprian/GC2-sheet
  - https://youtu.be/n2dFlSaBBKo
  - https://services.google.com/fh/files/blogs/gcat_threathorizons_full_apr2023.pdf
  - https://www.tanium.com/blog/apt41-deploys-google-gc2-for-attacks-cyber-threat-intelligence-roundup/
  - https://www.bleepingcomputer.com/news/security/hackers-abuse-google-command-and-control-red-team-tool-in-attacks/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_google_api_non_browser_access.yml
author: Gavin Knapp, Huntrule Team
date: 2023-05-01
modified: 2025-02-22
tags:
  - attack.command-and-control
  - attack.t1102
logsource:
  product: windows
  category: network_connection
detection:
  selection:
    DestinationHostname|contains:
      - drive.googleapis.com
      - oauth2.googleapis.com
      - sheets.googleapis.com
      - www.googleapis.com
  filter_optional_brave:
    Image|endswith: \brave.exe
  filter_optional_chrome:
    Image|endswith:
      - :\Program Files\Google\Chrome\Application\chrome.exe
      - :\Program Files (x86)\Google\Chrome\Application\chrome.exe
  filter_optional_google_drive:
    Image|contains: :\Program Files\Google\Drive File Stream\
    Image|endswith: \GoogleDriveFS.exe
  filter_optional_firefox:
    Image|endswith:
      - :\Program Files\Mozilla Firefox\firefox.exe
      - :\Program Files (x86)\Mozilla Firefox\firefox.exe
  filter_optional_ie:
    Image|endswith:
      - :\Program Files (x86)\Internet Explorer\iexplore.exe
      - :\Program Files\Internet Explorer\iexplore.exe
  filter_optional_maxthon:
    Image|endswith: \maxthon.exe
  filter_optional_edge_1:
    - Image|contains: :\Program Files (x86)\Microsoft\EdgeWebView\Application\
    - Image|endswith:
        - :\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        - :\Program Files\Microsoft\Edge\Application\msedge.exe
        - \WindowsApps\MicrosoftEdge.exe
  filter_optional_edge_2:
    Image|contains:
      - :\Program Files (x86)\Microsoft\EdgeCore\
      - :\Program Files\Microsoft\EdgeCore\
    Image|endswith:
      - \msedge.exe
      - \msedgewebview2.exe
  filter_optional_opera:
    Image|endswith: \opera.exe
  filter_optional_safari:
    Image|endswith: \safari.exe
  filter_optional_seamonkey:
    Image|endswith: \seamonkey.exe
  filter_optional_vivaldi:
    Image|endswith: \vivaldi.exe
  filter_optional_whale:
    Image|endswith: \whale.exe
  filter_optional_googleupdate:
    Image|endswith: \GoogleUpdate.exe
  filter_optional_outlook_exe:
    Image|endswith: \outlook.exe
  filter_main_null:
    Image: null
  filter_main_empty:
    Image: ""
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Legitimate applications communicating with the "googleapis.com" endpoints that are not already in the exclusion list. This is environmental dependent and requires further testing and tuning.
level: medium
license: DRL-1.1
related:
  - id: 7e9cf7b6-e827-11ed-a05b-0242ac120003
    type: derived