QuestionQ17
Threat huntingYou are a SOC analyst at an organization that uses Google Security Operations (SecOps). You are investigating suspicious activity in your organization’s environment. Google SecOps alerts show repeated PowerShell activity on a group of endpoints. Outbound connections are being made to a domain that is absent from your threat intelligence feeds. The activity takes place across multiple systems and user accounts. You must search across affected systems and user identities to identify the malicious user and determine the scope of the compromise. What should you do?
- A Perform a YARA-L 2.0 search to correlate activity across impacted systems and users.
- B Perform a raw log search for the suspicious domain string, and manually pivot to related user activity.
- C Use the User Sign-In Overview dashboard to monitor authentication trends and anomalies across all users.
- D Use the Behavioral Analytics dashboard in Risk Analytics to identify abnormal IP-based activity and high-risk user behavior.
Community Discussion