QuestionQ17

Threat hunting

You are a SOC analyst at an organization that uses Google Security Operations (SecOps). You are investigating suspicious activity in your organization’s environment. Google SecOps alerts show repeated PowerShell activity on a group of endpoints. Outbound connections are being made to a domain that is absent from your threat intelligence feeds. The activity takes place across multiple systems and user accounts. You must search across affected systems and user identities to identify the malicious user and determine the scope of the compromise. What should you do?

  • A Perform a YARA-L 2.0 search to correlate activity across impacted systems and users.
  • B Perform a raw log search for the suspicious domain string, and manually pivot to related user activity.
  • C Use the User Sign-In Overview dashboard to monitor authentication trends and anomalies across all users.
  • D Use the Behavioral Analytics dashboard in Risk Analytics to identify abnormal IP-based activity and high-risk user behavior.
Explanation

YARA-L 2.0 search can correlate multiple event types and group them by shared variables such as user identity and hostname within a time window. This enables investigation of the PowerShell activity, network connections to the suspicious domain, affected endpoints, and associated users as one cross-entity pattern.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!