Windows: GoogleUpdate.exe Self-Spawn From Uncommon Path
Alerts when GoogleUpdate.exe launches another GoogleUpdate.exe from an unusual directory.
FreeReviewedSigma · High · v5
- Product
- windows
- Category
- process_creation
- Author
- X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-15
- Updated
- 2026-07-31
What it detects
This rule identifies cases where GoogleUpdate.exe launches a new instance of itself, indicated by both the parent and child process images ending with \GoogleUpdate.exe. It highlights suspicious self-spawning behavior when the child executable path does not match common Google installation and update locations. The detection relies on Windows process creation telemetry, matching process image paths and excluding known benign start locations.
Reporting behind it
- ncsc.gov.ukhttps://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/Goofy-Guineapig/proc_creation_win_malware_goofy_guineapig_googleupdate_uncommon_child_instance.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-creation-googleupdate-exe-self-spawn-from-uncommon-path-bdbab15a
title: "Windows: GoogleUpdate.exe Self-Spawn From Uncommon Path"
id: 8a9de8f9-024a-4cbf-ba29-62764de1718c
status: test
description: This rule identifies cases where GoogleUpdate.exe launches a new instance of itself, indicated by both the parent and child process images ending with \GoogleUpdate.exe. It highlights suspicious self-spawning behavior when the child executable path does not match common Google installation and update locations. The detection relies on Windows process creation telemetry, matching process image paths and excluding known benign start locations.
references:
- https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/Goofy-Guineapig/proc_creation_win_malware_goofy_guineapig_googleupdate_uncommon_child_instance.yml
author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-15
tags:
- detection.emerging-threats
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \GoogleUpdate.exe
Image|endswith: \GoogleUpdate.exe
filter_main_legit_paths:
- Image|startswith:
- C:\Program Files\Google\
- C:\Program Files (x86)\Google\
- Image|contains: \AppData\Local\Google\Update\
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: bdbab15a-3826-48fa-a1b7-723cd8f32fcc
type: derived