Browser fetches Google Sheets gviz/tq API without prior doc activity

Ankit Mehta@Secvyn

•updated 29 days ago•1•0•2

Detects browser-based network requests to the Google Sheets Visualization API (gviz/tq) that appear to be used for fetching malicious JavaScript payloads from public Google Sheets. The rule specifically identifies instances where a process initiates these requests without any corresponding active browser session associated with standard Google Docs or Sheets editing activity.