Google Apps Script Sidebar C2 Communication (script.google.com)

Ibrahim Saud@tektrix

•updated 22 days ago•1•0•4

Detects browser-based network requests to 'script.google.com'. This can indicate usage of Google Apps Scripts, which are sometimes abused by attackers for Command and Control (C2) infrastructure, data exfiltration, or as a proxy for malicious payloads, by blending in with legitimate Google traffic.