QuestionQ77
Detection engineeringYou have been assigned to create a YARA-L detection rule in Google Security Operations (SecOps). The rule must identify when an internal host starts a network connection to an external IP address that the Applied Threat Intelligence Fusion Feed links to indicators attributed to the specific Advanced Persistent Threat 41 (APT41) threat group.
Ensure that the external IP address is flagged when it has a documented relationship to other APT41 indicators in the Fusion Feed. How should this YARA-L rule be configured?
- A Configure the rule to detect outbound network connections to the external IP address. Create a Google SecOps SOAR playbook that queries the Fusion Feed to determine if the IP address has an APT41 relationship.
- B Configure the rule to establish a join between the live network connection event and Fusion Feed data for the common external IP address. Filter the joined Fusion Feed data for explicit associations with the APT41 threat group or related indicators.
- C Configure the rule to check whether the external IP address from the network connection event has a high confidence score across any enabled threat intelligence feed.
- D Configure the rule to trigger when the external IP address from the network connection event matches an entry in a manually pre-curated reference list of all APT41-related IP addresses.
Community Discussion