Question

A threat intelligence report from Google Threat Intelligence (GTI) attributes a recent campaign to a group that stages payloads on a rotating set of newly registered domains, all sharing a distinctive TLS certificate serial number. Your SecOps team wants to run a hypothesis-driven hunt to determine whether any endpoints in your environment have contacted infrastructure matching this campaign, even if the specific domains in the report are not yet observed in your logs. Which approach best supports this hunt in Google SecOps?

Accepted Answer

Pivot on the shared TLS certificate serial number across network.tls UDM fields, and correlate any matching connections with GTI enrichment to confirm attribution and low prevalence.

Answer

Create a static reference list of the exact domains listed in the GTI report and build a UDM search that alerts only when those FQDNs appear in DNS logs.

Answer

Configure a YARA-L rule that fires on any outbound connection to a newly registered domain, regardless of certificate or GTI attribution.

Answer

Increase data retention to the maximum tier so that historical DNS logs for the reported domains are preserved for future correlation.