PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER · Question #29
You have been tasked with creating a YARA-L detection rule in Google Security Operations (SecOps). The rule should identify when an internal host initiates a network connection to an external IP…
The correct answer is B. Configure the rule to establish a join between the live network connection event and Fusion Feed. The correct configuration is to join live network connection events with Fusion Feed data on the external IP address and filter for explicit associations with APT41 or related indicators. This ensures that the detection not only matches direct IP addresses but also flags those…
Question
You have been tasked with creating a YARA-L detection rule in Google Security Operations (SecOps). The rule should identify when an internal host initiates a network connection to an external IP address that the Applied Threat Intelligence Fusion Feed associates with indicators attributed to a specific Advanced Persistent Threat 41 (APT41) threat group. You need to ensure that the external IP address is flagged if it has a documented relationship to other APT41 indicators within the Fusion Feed. How should you configure this YARA-L rule?
Options
- AConfigure the rule to detect outbound network connections to the external IP address. Create a
- BConfigure the rule to establish a join between the live network connection event and Fusion Feed
- CConfigure the rule to check whether the external IP address from the network connection event
- DConfigure the rule to trigger when the external IP address from the network connection event
How the community answered
(15 responses)- B80% (12)
- C13% (2)
- D7% (1)
Explanation
The correct configuration is to join live network connection events with Fusion Feed data on the external IP address and filter for explicit associations with APT41 or related indicators. This ensures that the detection not only matches direct IP addresses but also flags those with documented relationships to APT41 in the Fusion Feed, providing broader and more accurate detection than static lists or general confidence scores.
Topics
Community Discussion
No community discussion yet for this question.