Identifying Malicious User and Scope in Google SecOps

PSOE Last updated

Performing threat hunting across environments.

Short answer

D Use the Behavioral Analytics dashboard in Risk Analytics to identify abnormal IP-based activity and high-risk user behavior.

Question

You are a SOC analyst at an organization that uses Google Security Operations (SecOps). You are investigating suspicious activity in your organization's environment. Alerts in Google SecOps indicate repeated PowerShell activity on a set of endpoints. Outbound connections are made to a domain that does not appear in your threat intelligence feeds. The activity occurs across multiple systems and user accounts. You need to search across impacted systems and user identities to identify the malicious user and understand the scope of the compromise. What should you do?

  1. Perform a YARA-L 2.0 search to correlate activity across impacted systems and users.
  2. Perform a raw log search for the suspicious domain string, and manually pivot to related user activity.
  3. Use the User Sign-In Overview dashboard to monitor authentication trends and anomalies across all users.
  4. Use the Behavioral Analytics dashboard in Risk Analytics to identify abnormal IP-based activity and high-risk user behavior. Correct Answer

Key Takeaways

The exam tests the distinction between manual log searching (detection) and automated behavioral analytics (investigation/scope), where Risk Analytics is the correct tool for understanding user context across environments.

This question explores how to identify the malicious user and scope of compromise using Google Security Operations' Risk Analytics Behavioral Insights when faced with multi-system PowerShell activity.

Common mistake: Candidates often select Option A (YARA-L) because it is a powerful search language, but they fail to realize that YARA-L is primarily for detection/correlation rules rather than the high-level behavioral investigation and risk scoring needed here.

Expert Analysis

Why the Answer Is Correct

Option D is the correct approach because the scenario requires investigating suspicious activity across multiple systems and user accounts to identify the specific malicious user. Google Security Operations' Behavioral Analytics (part of Risk Analytics) automatically processes ingested data to calculate risk scores for users and assets based on deviations from baselines. This dashboard allows analysts to see abnormal IP-based activity and high-risk user behavior, directly addressing the need to understand the scope of the compromise and pinpoint the malicious identity without manual pivoting.

Why the Other Options Are Wrong

Option A (YARA-L) is incorrect because while YARA-L can correlate events, it is a query language for building detection logic, not a pre-built investigative dashboard for behavioral risk assessment. Option B (Raw log search) is inefficient and manual; it lacks the aggregated view of user identity across systems required to quickly determine scope. Option C (User Sign-In Overview) focuses only on authentication trends and would miss the critical endpoint activity (PowerShell execution) and network connections described in the alert.

Community Comment Notes

Community feedback strongly supports Option D, with users noting that Behavioral Analytics is designed specifically to identify deviations from baseline behavior. One commenter highlighted that this feature calculates risk scores for every user and asset, making it ideal for this type of investigation. Another user correctly pointed out that while UEBA covers detection, the investigation phase leverages these insights to understand impact.

Exam Strategy

When investigating 'scope' and 'malicious user' in cloud security operations, look for answers involving 'Behavioral Analytics' or 'Risk' dashboards rather than raw logs or basic query languages. These tools provide the aggregated context needed to pivot effectively.

Frequently Asked Questions

Why not use YARA-L to find the malicious user?

YARA-L is for writing detection rules and correlating events. Behavioral Analytics provides pre-calculated risk scores and contextual insights into user anomalies, which is faster for investigation.

What is the difference between User Sign-In and Behavioral Analytics?

User Sign-In Overview tracks authentication events like logins. Behavioral Analytics analyzes broader activity patterns (like PowerShell usage and network connections) to detect deviations from baseline behavior.

More PSOE FAQ →

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded.

From public community threads 3

  1. c3tluna 👍 3 Answered D
    Behavioral Analytics (Risk Analytics): This feature of SecOps processes all ingested activity to calculate a risk score for every user and asset. It is designed to identify deviations from established baseline behavior (e.g., a user account suddenly executing PowerShell on multiple machines and initiating unusual outbound connections).
  2. ssdny 👍 1 Answered A
    A is Correct. UEBA only covers detection. You need to use YARA-L to determine the impact.
  3. Hamza_hmz123 👍 1 Answered D
    Risk Analytics

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Ingesting On-Prem NAS Logs into Google SecOps Without IP Aliasing

S-Grade

Which Log Source Completes principal.user.userid Matching?

S-Grade

Reducing Secops Alert Noise with High-Value Asset Context

S-Grade

← Back to PSOE Study Guide