PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER · Question #49
You are conducting a proactive threat hunt in Google Security Operations (SecOps). You observe multiple login events with the same principal.user.userid field that originate from different countries…
The correct answer is C. Perform a UDM search for login events, and pivot to group results by user and country of origin. The most direct way to validate if the account shows signs of compromise is to perform a UDM search for login events and group the results by user and country of origin. This allows you to clearly identify impossible travel patterns (same user logging in from different…
Question
You are conducting a proactive threat hunt in Google Security Operations (SecOps). You observe multiple login events with the same principal.user.userid field that originate from different countries within a short time window. You need to validate whether the account has been compromised. What should you do?
Options
- AUse the entity graph to correlate the user's risk score with linked assets, and review any active
- BPerform a YARA-L 2.0 search for login events and their associated principal.location.country field.
- CPerform a UDM search for login events, and pivot to group results by user and country of origin.
- DRun a YARA-L retrohunt rule that detects users who are logging in from multiple regions using
How the community answered
(27 responses)- A7% (2)
- B4% (1)
- C85% (23)
- D4% (1)
Explanation
The most direct way to validate if the account shows signs of compromise is to perform a UDM search for login events and group the results by user and country of origin. This allows you to clearly identify impossible travel patterns (same user logging in from different countries in a short time window), which is a strong indicator of account compromise.
Topics
Community Discussion
No community discussion yet for this question.