Suspicious Child Process of GoogleUpdate.exe on Windows
Alerts when GoogleUpdate.exe spawns an unexpected child process on Windows, using parent/child image telemetry and allowlisting common Google updaters.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-15
- Updated
- 2026-07-31
What it detects
This rule flags process creation events where the parent process is GoogleUpdate.exe and the spawned child does not match a small set of expected Google-related updater components. Attackers may abuse GoogleUpdate.exe to launch arbitrary payloads under a trusted parent, so the parent-child relationship is a useful behavioral signal. It relies on Windows process creation telemetry containing Image and ParentImage fields to evaluate parent identity and apply allowlist filtering.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Suspicious Child Process of GoogleUpdate.exe on Windows
id: a33521aa-315c-47f1-b6e6-5ca936b04fac
related:
- id: bdbab15a-3826-48fa-a1b7-723cd8f32fcc
type: derived
- id: 84b1ecf9-6eff-4004-bafb-bae5c0e251b2
type: derived
status: test
description: This rule flags process creation events where the parent process is GoogleUpdate.exe and the spawned child does not match a small set of expected Google-related updater components. Attackers may abuse GoogleUpdate.exe to launch arbitrary payloads under a trusted parent, so the parent-child relationship is a useful behavioral signal. It relies on Windows process creation telemetry containing Image and ParentImage fields to evaluate parent identity and apply allowlist filtering.
references:
- https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_googleupdate_susp_child_process.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-15
modified: 2023-05-22
tags:
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \GoogleUpdate.exe
filter_main_known_legit:
- Image|contains: \Google
- Image|endswith:
- \setup.exe
- chrome_updater.exe
- chrome_installer.exe
filter_main_image_null:
Image: null
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: high
license: DRL-1.1