Windows Process Creation: GoogleUpdate.exe Self-Spawn from Uncommon Path

Alerts when GoogleUpdate.exe launches another GoogleUpdate.exe from an unusual directory.

FreeUnreviewedSigmahighv1

windows-process-creation-googleupdate-exe-self-spawn-from-uncommon-path-bdbab15a

title: "Windows Process Creation: GoogleUpdate.exe Self-Spawn from Uncommon Path"
id: 8a9de8f9-024a-4cbf-ba29-62764de1718c
status: test
description: This rule flags process creation events where GoogleUpdate.exe spawns another instance of itself (parent and child image both end with \\GoogleUpdate.exe). Self-spawning in an unexpected location can indicate masquerading or malware persistence that abuses legitimate updater naming. The detection relies on Windows process creation telemetry, matching the parent/child executable names and excluding events where the child path is within common Google install and update locations.
references:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/Goofy-Guineapig/proc_creation_win_malware_goofy_guineapig_googleupdate_uncommon_child_instance.yml
author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-15
tags:
  - detection.emerging-threats
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \GoogleUpdate.exe
    Image|endswith: \GoogleUpdate.exe
  filter_main_legit_paths:
    - Image|startswith:
        - C:\Program Files\Google\
        - C:\Program Files (x86)\Google\
    - Image|contains: \AppData\Local\Google\Update\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: bdbab15a-3826-48fa-a1b7-723cd8f32fcc
    type: derived

What it detects

This rule flags process creation events where GoogleUpdate.exe spawns another instance of itself (parent and child image both end with \\GoogleUpdate.exe). Self-spawning in an unexpected location can indicate masquerading or malware persistence that abuses legitimate updater naming. The detection relies on Windows process creation telemetry, matching the parent/child executable names and excluding events where the child path is within common Google install and update locations.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.