Suspicious Non-Browser Network Communication With Google API

MITRE ATT&CK coverage

Event coverage

Stages and Predicates

or:
DestinationHostname|contains: drive.googleapis.com
DestinationHostname|contains: oauth2.googleapis.com
DestinationHostname|contains: sheets.googleapis.com
DestinationHostname|contains: www.googleapis.com

or:
Image: ''
Image: null

or:
or:
Image|endswith: '\msedge.exe'
Image|endswith: '\msedgewebview2.exe'
or:
Image|contains: ':\Program Files (x86)\Microsoft\EdgeCore\'
Image|contains: ':\Program Files\Microsoft\EdgeCore\'
Image|endswith: '\GoogleDriveFS.exe'
Image|contains: ':\Program Files\Google\Drive File Stream\'
Image|endswith: ':\Program Files (x86)\Google\Chrome\Application\chrome.exe'
Image|endswith: ':\Program Files (x86)\Internet Explorer\iexplore.exe'
Image|endswith: ':\Program Files (x86)\Microsoft\Edge\Application\msedge.exe'
Image|endswith: ':\Program Files (x86)\Mozilla Firefox\firefox.exe'
Image|endswith: ':\Program Files\Google\Chrome\Application\chrome.exe'
Image|endswith: ':\Program Files\Internet Explorer\iexplore.exe'
Image|endswith: ':\Program Files\Microsoft\Edge\Application\msedge.exe'
Image|endswith: ':\Program Files\Mozilla Firefox\firefox.exe'
Image|endswith: '\GoogleUpdate.exe'
Image|endswith: '\WindowsApps\MicrosoftEdge.exe'
Image|endswith: '\brave.exe'
Image|endswith: '\maxthon.exe'
Image|endswith: '\opera.exe'
Image|endswith: '\outlook.exe'
Image|endswith: '\safari.exe'
Image|endswith: '\seamonkey.exe'
Image|endswith: '\vivaldi.exe'
Image|endswith: '\whale.exe'
Image|contains: ':\Program Files (x86)\Microsoft\EdgeWebView\Application\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.