Question

A threat hunter at a financial services firm suspects that an attacker has deployed a rarely-used administrative utility across a small number of endpoints following a phishing campaign that began three days ago. The hunter wants to use Google SecOps UDM search to surface processes that are genuinely new to the environment, while avoiding false positives from legitimate tools that are simply uncommon but have existed for months. Which approach BEST supports identifying truly low-prevalence, recently-introduced processes?

Accepted Answer

Compare the set of process hashes seen in the last 3 days against a baseline of process hashes observed over the preceding 90 days, and investigate hashes that appear only in the recent window with low host counts.

Answer

Run a UDM search over the last 3 days grouped by process file hash and count of distinct hosts, then treat any hash appearing on fewer than five hosts as malicious.

Answer

Search only the last 24 hours for all process executions and sort by execution timestamp to find the most recent activity across all hosts.

Answer

Query the full 90-day retention window for every process and manually review each unique file name that does not appear on a corporate allowlist.