nerdexam
Google

PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER · Question #42

You are investigating whether an advanced persistent threat (APT) actor has operated in your organization's environment undetected. You have received threat intelligence that includes: - A SHA256…

The correct answer is A. Write a multi-event YARA-L detection rule that correlates the process relationship and hash, and. Since process hashes are not consistently available across all endpoints, relying solely on the DLL hash would miss activity. The best solution is to write a multi-event YARA-L detection rule that correlates the process relationship (rundll32.exe spawning powershell.exe with…

Threat Detection and Investigation

Question

You are investigating whether an advanced persistent threat (APT) actor has operated in your organization's environment undetected. You have received threat intelligence that includes:

  • A SHA256 hash for a malicious DLL
  • A known command and control (C2) domain
  • A behavior pattern where rundll32.exe spawns powershell.exe with obfuscated arguments

Your Google Security Operations (SecOps) instance includes logs from EDR, DNS, and Windows Sysmon. However, you have recently discovered that process hashes are not reliably captured across all endpoints due to an inconsistent Sysmon configuration. You need to use Google SecOps to develop a detection mechanism that identifies the associated activities. What should you do?

Options

  • AWrite a multi-event YARA-L detection rule that correlates the process relationship and hash, and
  • BBuild a reference list that contains the hash and domain, and link the list to a high-frequency rule
  • CCreate a single-event YARA-L detection rule based on the file hash, and run the rule against
  • DUse Google SecOps search to identify recent uses of rundll32.exe, and tag affected assets

How the community answered

(23 responses)
  • A
    83% (19)
  • B
    9% (2)
  • C
    4% (1)
  • D
    4% (1)

Explanation

Since process hashes are not consistently available across all endpoints, relying solely on the DLL hash would miss activity. The best solution is to write a multi-event YARA-L detection rule that correlates the process relationship (rundll32.exe spawning powershell.exe with obfuscated arguments) together with the C2 domain and hash when available, and run a retrohunt. This approach detects both behavior-based and IOC-based indicators, ensuring coverage even when hashes are missing.

Topics

#APT detection#YARA-L multi-event#process correlation#Sysmon logs

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice