Suspicious Curl to Google App Script Endpoint

ELASTIC detection rule by Elastic · Elastic License v2

Detects the use of curl to a Google Script endpoint for the purpose of downloading a second stage payload or tool. Threat actors utilize exposed Google Script endpoints to host payloads as Google URLs are generally whitelisted and bypass security controls.

[metadata]
creation_date = "2026/01/30"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/03/24"

[rule]
author = ["Elastic"]
description = """
Detects the use of curl to a Google Script endpoint for the purpose of downloading a second stage payload 
or tool. Threat actors utilize exposed Google Script endpoints to host payloads as Google URLs are 
generally whitelisted and bypass security controls.
"""
from = "now-9m"
index = ["logs-endpoint.events.process-*", "logs-endpoint.events.network-*"]
language = "eql"
license = "Elastic License v2"
name = "Suspicious Curl to Google App Script Endpoint"
references = [
    "https://www.google.com/script/start/",
    "https://attack.mitre.org/techniques/T1105/"
]
risk_score = 73
rule_id = "6b82a0ce-10ac-4cb7-8a66-0ba4d24540cf"
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: macOS",
    "Use Case: Threat Detection",
    "Tactic: Command and Control",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide"
]
type = "eql"
note = """## Triage and analysis

> **Disclaimer**:
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

### Investigating Suspicious Curl to Google App Script Endpoint

Google Apps Script is a cloud-based development platform that allows users to extend Google Workspace functionality with custom scripts. Threat actors abuse this legitimate service to host malicious scripts that serve as command and control endpoints, taking advantage of the trusted domain reputation and SSL certificates. This detection rule identifies curl connections to Google Apps Script endpoints from macOS systems, which may indicate C2 communication or payload retrieval from attacker-controlled scripts.

### Possible investigation steps

- Review the process.parent.executable and process.command_line fields to understand what application or script initiated the curl request to Google Apps Script.
- Extract the full URL from process.args to identify the specific Apps Script deployment being accessed and determine if it belongs to your organization.
- Analyze the process.Ext.effective_parent.executable to trace the execution chain and identify the root cause of the suspicious activity.
- Check Google Workspace admin logs if available to review the Apps Script deployment and its contents for malicious code.
- Investigate the user.name associated with the activity to determine if the behavior aligns with their normal duties.
- Review network response data if captured to identify any commands, payloads, or exfiltrated data transmitted via the Apps Script endpoint.
- Search for similar curl to Google Apps Script activity across other endpoints to assess the scope of potential compromise.

### False positive analysis

- Legitimate business automation may use Google Apps Script for workflow integrations. Verify with the script owner and confirm the Apps Script belongs to your organization.
- MDM and management tools like Kandji may interact with Google services legitimately. These are already excluded in the query but verify if additional tools should be added.
- Marketing and analytics platforms may use Apps Script for data collection. Confirm these are sanctioned business applications.
- Development and testing activities may involve Apps Script integrations. Coordinate with development teams to understand expected activities.

### Response and remediation

- Immediately block the suspicious Google Apps Script URL at the proxy or web filter to prevent ongoing C2 communication.
- Terminate the curl process and any parent processes that initiated the suspicious activity.
- Isolate the affected macOS system from the network while conducting forensic analysis.
- Report the malicious Apps Script to Google through their abuse reporting mechanisms to initiate takedown.
- Conduct a thorough scan of the affected system for additional malware, persistence mechanisms, or exfiltrated data.
- Review authentication logs for the affected user account and reset credentials if compromise is suspected.
- Search for similar activity across the environment to identify additional affected systems.
- Implement enhanced monitoring for connections to script.google.com from unexpected applications.
"""
query = '''
sequence by process.entity_id with maxspan=15s
  [process where host.os.type == "macos" and event.type == "start" and process.name in ("curl", "nscurl") and
    not process.Ext.effective_parent.executable like "/Library/Kandji/Kandji Agent.app/Contents/Helpers/Kandji Library Manager.app/Contents/MacOS/kandji-library-manager"]
  [network where host.os.type == "macos" and event.type == "start" and process.name in ("curl", "nscurl") and 
    destination.domain in ("script.google.com", "script.google.com.")]
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"

[[rule.threat.technique.subtechnique]]
id = "T1071.001"
name = "Web Protocols"
reference = "https://attack.mitre.org/techniques/T1071/001/"

[[rule.threat.technique]]
id = "T1102"
name = "Web Service"
reference = "https://attack.mitre.org/techniques/T1102/"

[[rule.threat.technique.subtechnique]]
id = "T1102.002"
name = "Bidirectional Communication"
reference = "https://attack.mitre.org/techniques/T1102/002/"

[[rule.threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"

[rule.threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

6296b094-8a05-47df-b6e8-2bb22b27514f

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion