Non-prioritized IoC Matching threats

This document outlines the expansion of curated detections through the integration of Google's Indicators of Compromise (IoC) feeds. These rule sets build on curated threat intelligence to identify malicious activities within Google Security Operations environments, specifically focusing on threats identifiable through high-fidelity indicators like IPs, domains, and file hashes.

For Google SecOps Enterprise Plus customers, rule sets in this category are enabled by default. The status is set to Enabled for both Precise and Broad rules to support producer and composite detections and populate IOC metadata. However, these rules are not designed to generate noise in your alert queue. Consequently, Alerting is set to Off by default. This allows the system to match high-volume curated IoCs from Google's feeds and support deeper correlation without generating alert fatigue.

If you customize these settings, Google recommends keeping Alerting set to Off for this category.

The non-prioritized IoC Matching rules category provides comprehensive coverage for threats often missed by standard managed content, including cryptomining, Command and Control (C2) communications, and the use of malicious anonymization services. The Applied Threat Intelligence curated detections are Mandiant-based and use prioritization logic for alerts (Active Breach or High designations), while the non-prioritized IoC Matching category focuses on matching a high volume of curated IoCs from Google's feeds to exclusively identify specific threat activities.

Rule set descriptions

The Applied Threat Intelligence - Non-prioritized IOC Matching category includes the following rule sets:

• Applied Threat Intelligence - Non-prioritized Domain IOC Matching
• Applied Threat Intelligence - Non-prioritized File IOC Matching
• Applied Threat Intelligence - Non-prioritized IP IOC Matching
• Applied Threat Intelligence - Curated Composites

These rule sets contain logic designed to detect direct hits against specific Google IoC feeds. They function as producer rules that tag security-relevant events and populate metadata for deeper correlation, rather than generating direct alerts.

Understand Non-prioritized IoC Matching identification rules

These rules utilize direct matching against Google's IoC Feeds to tag security-relevant events. They are designed to function as the identification layer of the detection funnel, providing high-confidence indicators of malicious infrastructure or tools.

Supported Indicators and Log types

The rules rely on Google SecOps Unified Data Model (UDM) records, which normalize various log sources to match against the following feed types:

Modify rules in a rule set

Following the standard Mandiant Hunt configuration, you can adjust how IoC Matching rules operate within your environment:

• Broad: Detects any potentially malicious feed hit. While providing maximum visibility, this may increase detection volume for common indicators like VPN or Proxy IPs. Also, it is advisable not to enable alerting for these broad rules while keeping the detection on.
• Precise: Focuses on the highest-confidence behavioral clusters to minimize noise.

To modify settings, use the Google SecOps rules list to toggle the Status (Enabled/Disabled) and Alerting (On/Off) for each rule.

Tune alerts from rule sets

Use rule exclusions to prevent specific authorized internal tools or known-good traffic from triggering ATI-based alerts. This helps you maintain a high signal-to-noise ratio and is particularly useful for excluding authorized use of administrative tools that might otherwise be flagged by RMM tool feeds.

For examples of custom YARA-L rules using IoC feeds, see IP address matching against indicators of compromise.

Need more help? Get answers from Community members and Google SecOps professionals.