Question

A threat hunter receives a GTI report describing a novel loader identified by a specific SHA-256 hash. They confirmed one endpoint executed the file. To test the hypothesis that the loader has spread laterally, the hunter wants to determine which other hosts in the enterprise have executed the same binary and how recently each first saw it. Using UDM search in Google SecOps, which approach most directly and efficiently supports this pivot?

Accepted Answer

Search PROCESS_LAUNCH events filtering on target.process.file.sha256 equal to the IOC hash, then group results by principal.hostname and aggregate the minimum metadata.event_timestamp per host

Answer

Search NETWORK_CONNECTION events for the IOC hash in target.ip and group by principal.hostname to find beaconing destinations

Answer

Add the SHA-256 to a reference list and wait for a scheduled YARA-L detection rule to alert on future executions across the fleet

Answer

Query FILE_CREATION events filtering on principal.process.file.sha256 and count total events without grouping by host