Question

During a proactive hunt in Google SecOps, a threat hunter suspects that an attacker deployed a custom loader across a small number of workstations. The hunter wants to surface executables that have been observed on very few hosts and only appeared in the environment within the last 3 days, without relying on any known IOC. Which UDM search approach best supports this hypothesis?

Accepted Answer

Search process launch events, aggregate by target.process.file.sha256, and filter for hashes with a low distinct count of principal.hostname whose earliest metadata.event_timestamp falls within the last 3 days

Answer

Query network connection events and filter for target.ip addresses that match entries in a curated GTI malicious IP feed

Answer

Run a YARA-L rule that matches process names against a reference list of known LOLBins and alerts on any match

Answer

Search authentication events and aggregate by principal.user.userid to find accounts with anomalous login volume in the last 3 days