Professional Security Operations EngineerDemo

By Google · Question Mode

QuestionQ83

Threat hunting

Your team is accountable for cybersecurity at a large multinational corporation. You have been assigned to identify unknown command-and-control nodes (C2s) that may be active in your organization's environment. You must generate a list of possible matches within the next 24 hours. What should you do?

  • A Write a rule in Google Security Operations (SecOps) that scans historic network outbound connections against ingested threat intelligence Run the rule in a retrohunt against the full tenant.
  • B Load network records into BigQuery to identify endpoints that are communicating with domains outside three standard deviations of normal.
  • C Review Security Health Analytics (SHA) findings in Security Command Center (SCC).
  • D Write a YARA-L rule in Google Security Operations (SecOps) that compares network traffic of endpoints to low prevalence domains against recent WHOIS registrations.
Explanation

Google Security Operations retrohunt runs a YARA-L detection rule against historical data, allowing outbound network connections across the tenant to be matched with ingested threat-intelligence indicators. This is an appropriate way to find systems that have communicated with known malicious or C2 infrastructure that was previously undetected.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!