Professional Security Operations EngineerDemo

By Google · Question Mode

QuestionQ92

Detection engineering

You are investigating whether an advanced persistent threat (APT) actor has been operating undetected in your organization's environment. You have received threat intelligence that includes:

  • A SHA256 hash for a malicious DLL
  • A known command and control (C2) domain
  • A behavior pattern in which rundll32.exe spawns powershell.exe with obfuscated arguments

Your Google Security Operations (SecOps) instance contains logs from EDR, DNS, and Windows Sysmon. However, you recently discovered that process hashes are not captured reliably across all endpoints because the Sysmon configuration is inconsistent. You need to use Google SecOps to develop a detection mechanism that identifies the related activities. What should you do?

  • A Write a multi-event YARA-L detection rule that correlates the process relationship and hash, and run a retrohunt based on this rule.
  • B Build a reference list that contains the hash and domain, and link the list to a high-frequency rule for near real-time alerting.
  • C Create a single-event YARA-L detection rule based on the file hash, and run the rule against historical and incoming telemetry to detect the DLL execution.
  • D Use Google SecOps search to identify recent uses of rundll32.exe, and tag affected assets for watchlisting.
Explanation

A multi-event YARA-L rule can correlate the suspicious rundll32.exe to obfuscated powershell.exe process relationship with related DNS activity to the known C2 domain, using the DLL hash as corroborating evidence when present. This behavioral, cross-source approach remains effective when hash collection is incomplete. A retrohunt applies the rule to retained telemetry to identify earlier, previously undetected activity; a hash-only rule would miss endpoints that did not record process hashes.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!