SHEETCREEP APT36 Google Sheets C2 via Non-Browser Process to sheets.googleapis.com
Detects unusual processes making multiple connections to Google Sheets or OAuth2 APIs within a short timeframe, excluding known browsers and Google applications. This could indicate unauthorized data access, exfiltration, or command and control activity.
Microsoft Sentinel (KQL)
