Question

A threat hunter forms a hypothesis that a recently observed malware family establishes command-and-control by beaconing to newly registered domains (NRDs). She wants to build a YARA-L rule in Google SecOps that surfaces regular, periodic HTTP connections to domains that have low prevalence across the organization AND were first observed in the environment within the last 7 days. Which approach best implements this hypothesis-driven hunt?

Accepted Answer

Write a YARA-L rule that matches network.http events, correlates the destination domain against a prevalence/first-seen enrichment, and uses a match window with an event-count threshold to detect periodic low-prevalence beaconing.

Answer

Create a static reference list of every domain seen in the last 30 days and write a rule that alerts whenever any destination domain appears in that list.

Answer

Configure a data retention tier to keep DNS logs longer, then manually review the raw logs each morning for suspicious domains.

Answer

Write a single-event UDM search filtering only on metadata.event_type = NETWORK_DNS and export the results to a spreadsheet for offline pivoting.