Windows: Suspicious Child Processes Spawned by GoogleUpdate.exe

Alerts when GoogleUpdate.exe spawns an unexpected child process on Windows, using parent/child image telemetry and allowlisting common Google updaters.

FreeUnreviewedSigmahighv1

windows-suspicious-child-processes-spawned-by-googleupdate-exe-84b1ecf9

title: "Windows: Suspicious Child Processes Spawned by GoogleUpdate.exe"
id: a33521aa-315c-47f1-b6e6-5ca936b04fac
related:
  - id: bdbab15a-3826-48fa-a1b7-723cd8f32fcc
    type: derived
  - id: 84b1ecf9-6eff-4004-bafb-bae5c0e251b2
    type: derived
status: test
description: This rule flags process creation events where the parent process is GoogleUpdate.exe and the spawned child does not match a set of known/expected Google-related or installer/updater binaries. Attackers may abuse GoogleUpdate to run additional tooling under a legitimate parent process, so identifying unexpected child processes can help detect stealthy execution. It relies on Windows process creation telemetry, including parent and child process image paths, and filters out specific common legitimate child executables.
references:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_googleupdate_susp_child_process.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-15
modified: 2023-05-22
tags:
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \GoogleUpdate.exe
  filter_main_known_legit:
    - Image|contains: \Google
    - Image|endswith:
        - \setup.exe
        - chrome_updater.exe
        - chrome_installer.exe
  filter_main_image_null:
    Image: null
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags process creation events where the parent process is GoogleUpdate.exe and the spawned child does not match a set of known/expected Google-related or installer/updater binaries. Attackers may abuse GoogleUpdate to run additional tooling under a legitimate parent process, so identifying unexpected child processes can help detect stealthy execution. It relies on Windows process creation telemetry, including parent and child process image paths, and filters out specific common legitimate child executables.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.