Rule Info
Tags
attack.defense_evasion DEMO
Name
Potentially Suspicious GoogleUpdate Child Process
Id
84b1ecf9-6eff-4004-bafb-bae5c0e251b2
Date
2023-05-15 00:00:00
Modified
2023-05-22 00:00:00
Description
Detects potentially suspicious child processes of "GoogleUpdate.exe"
Author
Nasreddine Bencherchali (Nextron Systems)
Type
Community Rule
Link to Public Repo
Scan your endpoints, forensic images or collected files with our portable scanner THOR