Question

A threat intel bulletin from GTI reports a new malware campaign associated with a specific SHA-256 file hash and warns it may have been active for up to 45 days before public disclosure. Your organization's Google SecOps tenant retains 90 days of UDM data. You want to form a hypothesis-driven hunt to determine whether this hash ever executed anywhere in your environment, prioritizing completeness over speed. Which approach best fits this hunting goal?

Accepted Answer

Run a UDM search for target.process.file.sha256 equal to the IOC hash across the full 90-day retention window, then pivot on any matching principal.hostname and metadata.event_timestamp to scope affected assets.

Answer

Deploy a real-time YARA-L single-event rule matching the hash so future executions generate alerts, and consider the hunt complete once the rule is live.

Answer

Query only the last 24 hours of UDM PROCESS_LAUNCH events for the hash to confirm the malware is not currently running before escalating.

Answer

Add the hash to a reference list and wait for curated detections to correlate it automatically over the coming weeks.