Question

A threat hunter at a manufacturing company suspects that an attacker deployed a rarely-seen dropper across a small number of endpoints after an initial phishing compromise. She wants to surface processes that have executed on very few hosts across the fleet within the last 14 days, prioritizing binaries that appear on only one or two distinct assets. Which Google SecOps UDM search approach best supports this prevalence-based hunting hypothesis?

Accepted Answer

Run a UDM search filtered to metadata.event_type = PROCESS_LAUNCH, then aggregate by target.process.file.sha256 with a distinct count of principal.hostname, and filter for counts of 1 or 2 across the 14-day window.

Answer

Create a YARA-L single-event rule that alerts on every PROCESS_LAUNCH event and manually review each detection to identify uncommon binaries.

Answer

Search NETWORK_CONNECTION events grouped by target.ip and filter for destinations contacted by the most hosts to find the widely-distributed dropper.

Answer

Ingest a reference list of known-good hashes and configure data retention to a compliance tier so historical process data is preserved longer for review.