Question

A threat hunter in Google SecOps wants to identify PowerShell child processes that have executed across only one or two hosts in the entire enterprise over the past 90 days, as a way to surface anomalous, low-prevalence activity. They write a UDM search filtering on target.process.file.full_path matching powershell.exe and group results, but the query returns hundreds of hosts and no useful low-prevalence signal. What is the MOST likely reason the hunt failed to surface rare activity, and how should it be corrected?

Accepted Answer

The search counts raw event occurrences rather than distinct hosts; the hunter should aggregate by a distinct count of principal.hostname (or asset ID) per process command line and filter for a low distinct-host count.

Answer

UDM search cannot measure prevalence at all; the hunter must export the events to BigQuery and run a SQL COUNT before any prevalence conclusion can be drawn.

Answer

The 90-day window is too short to establish prevalence; extending it to 365 days will automatically reduce the number of matching hosts.

Answer

Matching only on file.full_path is invalid; the hunter must instead match on target.process.file.sha256 because prevalence can only be computed on hashes.