diff --git a/rules/windows/command_and_control_common_webservices.toml b/rules/windows/command_and_control_common_webservices.toml index f294ae465..f6703c421 100644 --- a/rules/windows/command_and_control_common_webservices.toml +++ b/rules/windows/command_and_control_common_webservices.toml @@ -2,7 +2,7 @@ creation_date = "2020/11/04" integration = ["endpoint"] maturity = "production" -updated_date = "2024/05/21" +updated_date = "2024/07/16" [transform] [[transform.osquery]] @@ -217,7 +217,9 @@ network where host.os.type == "windows" and network.protocol == "dns" and "*.zulipchat.com", "webhook.site", "run.mocky.io", - "mockbin.org") and + "mockbin.org", + "www.googleapis.com", + "googleapis.com") and /* Insert noisy false positives here */ not (