Professional Security Operations EngineerDemo

By Google · Question Mode

QuestionQ78

Threat hunting

You are using Google Security Operations (SecOps) to hunt for indications of lateral movement through Remote Desktop Protocol (RDP) in your organization. You suspect a compromised account accessed multiple internal systems within a short time window. You want to build a UDM-based search to detect this activity. How should you construct this query?

Choose two
  • A Filter for RDP connections with non-standard ports.
  • B Filter for events using protocol-level attributes that indicate RDP connections.
  • C Group events by user identity and time to identify repeated access patterns.
  • D Correlate events based on the asset role or classification such as database or user workstation.
  • E Use a saved search to identify all events with the LATERAL_MOVEMENT tag over the past 30 days.
Explanation

UDM search can filter network activity using fields that identify RDP, such as the RDP destination port and related network attributes. Search results can also be grouped by identity and a time granularity, allowing repeated access by the same user within a short interval to be identified as a potential lateral-movement pattern.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!