Question

During post-incident activities for a resolved credential-phishing case in Google SecOps, your team confirmed the attacker used a specific set of newly registered domains and a phishing kit hash that were NOT detected proactively. Leadership wants to ensure the organization can immediately identify whether these same indicators appeared elsewhere in the environment during the incident window AND be alerted if they recur. Which combination of post-incident actions BEST satisfies both goals?

Accepted Answer

Add the domains and hash to a reference list, run a retrohunt over the historical incident window to surface prior matches, and deploy a live YARA-L rule referencing that list for future recurrence.

Answer

Open a new case per indicator and manually search the UDM event viewer once for each domain and hash without creating any persistent detection.

Answer

Submit the indicators to the threat intel team and wait for the next quarterly curated detection update to include coverage.

Answer

Increase data retention on all log sources so the indicators remain searchable, then rely on analysts to manually check dashboards weekly.