Question

A threat hunter at a financial services firm receives a GTI report describing a campaign that stages malware by writing a payload to an uncommon directory and then registers a Windows service pointing to that path. The hunter wants to convert this one-time investigation into ongoing coverage that continuously evaluates streaming EDR telemetry, automatically raises an alert whenever a service is created whose binary path has been seen on fewer than three hosts in the last 30 days, and preserves the matched event context for triage. Which Google SecOps approach best satisfies these requirements?

Accepted Answer

Author a YARA-L detection rule with an outcome section that computes host prevalence over a sliding window and fires when the service binary path count is below the threshold.

Answer

Run a UDM search that groups service-creation events by binary path and counts distinct hosts, then re-run the query manually each morning during the hunt shift.

Answer

Create a reference list of the suspicious directory paths from the GTI report and filter all raw logs against it at ingestion time.

Answer

Configure a data retention tier that keeps service-creation logs for 30 days so prevalence can always be recalculated on demand.