The Weekly Brief

July 28, 2026 YARA-L Rule Structure Every YARA-L rule follows five sections: meta (author, severity, MITRE mapping), events (UDM field conditions), match (grouping variable and time window), outcome (alert payload), and condition (firing threshold). YARA-L uses standard UDM fields and evaluates them continuously.Your First Rule: Brute Force Login Detection rule detect_brute_force_login { meta: author = "SecOps Team" description = "Detects multiple failed login attempts from a single source" severity = "MEDIUM" mitre_attack = "T1110" events: $login.metadata.event_type = "USER_LOGIN" $login.security_result.action = "BLOCK" $login.principal.ip = $source_ip $login.target.user.userid = $target_user match: $source_ip over 15m outcome: $failed_count = count($login) $targeted_users = count_distinct($target_user) $user_list = array_distinct($target_user) condition: $login and $failed_count >= 10}Section-by-Section Breakdown meta: Descriptive fields

This weeks update is brought to you by Chris Martin, Google Security Specialist.  What’s New in Google SecOps for the interval July 20 through July 27th 2026.Highlights🔥 The preview of CodeMender to find and fix software vulnerabilities🔥 Customizable schedules for YARA-L multi-event rules is now in Public Preview🤔 Google Threat Intelligence has released a new Cyber Threat Actor Naming System🔥 A Google SecOps update improving the integration with Wiz Defend🔥 SecOps SIEMposium 2026 — A Google SecOps-Focused Conference, Oct 5–8 in San DiegoSecOps SIEMposiumEarly bird registration is now open for SecOps SIEMposium, happening October 5-8, 2026 in San Diego. Join the Google…www.siemposium.com Product Updates & New Features🔥🚀 Now in preview: Find and fix software vulnerabilities with CodeMender from Google Cloud Blog Google Cloud is launching CodeMender in preview, a managed code security agent designed to help find and automatically remediate software vulnerabilities using machine

July 21, 2026 Why Service Accounts Are High-Value Targets Service accounts are the keys to your cloud kingdom. Unlike human accounts, they rarely have MFA, they often hold broad permissions, and their activity is easy to overlook because "that is just automation." Attackers know this. A compromised service account gives persistent, privileged access without triggering the usual user-behavior alerts. Using UDM Search, we can hunt for the telltale signs. Query 1: Service Account Logins from Unexpected IPs Service accounts typically authenticate from a small set of known compute resources. Logins from outside that range deserve investigation. The query is formatted below: metadata.event_type = "USER_LOGIN" AND metadata.log_type = "GCP_CLOUDAUDIT" AND principal.user.email_addresses = /gserviceaccount\.com/ AND NOT net.ip_in_range_cidr(principal.ip, "10.0.0.0/8") This query finds any GCP service account authenticating from an IP outside your internal `10.0.0.0/8` range. Replace the CIDR wit

This weeks update is brought to you by Chris Martin, Google Security Specialist.  What’s New in Google SecOps for the interval July 13 through July 19 2026  What’s New in Google SecOps — July 19th 2026Product Updates & New Features Google SecOps🚀 Release Notes from Google Cloud DocsA new ‘Advanced Filtering in Dashboards’ feature is now available in Preview for security analysts, allowing dynamic values, regex, or boolean logic to be injected into YARA-L queries at runtime. [Read More]I wrote a blog on using Advanced Filters in Native Dashboards recently.A new feature allowing users to check the validation status of a SOAR migration to Google Cloud, with specific indicators for successful completion of Stage 1 and Stage 2 on the License Management page. [Read More] Google Threat Intelligence🚀 Release Notes from gtidocs.readme.ioNew product updates for July 2026, including an enhanced URL Scanning 2.0, Role-Based Access Control for Service Accounts, and improved audit log capabili

The explosion of Internet of Things devices has fundamentally transformed the modern network edge, but it has also introduced significant security vulnerabilities. Traditional endpoint security tools are often constrained by a reliance on static x86/x64 signatures, a limitation that sophisticated threat actors routinely exploit by deploying multi-architecture malware. To bridge this critical visibility gap, security teams require advanced telemetry and behavioral tools capable of tracking threats across diverse hardware architectures like ARM and MIPS.Google Threat Intelligence delivers these necessary capabilities by unifying massive global telemetry with automated analysis. Through Automated Capability Mapping, the platform automatically runs CAPA rules against incoming ELF binaries, uncovering the underlying intent of a file rather than just its surface-level semantics. This allows defenders to isolate hidden deployment pipelines and malicious payloads immediately, transforming a co

The global security landscape recently faced a substantial challenge with the disclosure of CVE-2026-31431, an impactful zero-day logic flaw widely known as "Copy Fail". Residing within the Linux kernel's cryptographic subsystem, this high severity local privilege escalation vulnerability has quietly affected major enterprise distributions since 2017. Alarmingly, an unprivileged local user can gain deterministic root execution using a remarkably small 732 byte Python script, making swift detection an absolute priority for system administrators.To help organizations counter this critical threat, Google Threat Intelligence offers robust capabilities to hunt, analyze, and neutralize exploit footprints before they disrupt production environments. Security teams can leverage Google Threat Intelligence Search to quickly identify targeted files, calculate commonalities on the findings, and map out in the wild distribution points. This effectively allows analysts to uncover the exact malicious

Traditional cybersecurity monitoring has long been plagued by excessive noise and high false positive ratios, forcing analysts to manually scrape underground forums for keywords. Google Threat Intelligence introduces a significant paradigm shift by utilizing Agentic AI to automate and deepen dark web investigations. Rather than relying on rigid, manual searches, this advanced technology sifts through millions of underground data events, seamlessly connecting raw illicit activity to an organization's specific risk profile.A standard investigation highlights how this feature functions in practice, moving from initial scoping to proactive defense. In a sample scenario exploring recent dark web marketplace trends, a security analyst can query the AI to identify web shells sold over the past 30 days. The Agentic AI efficiently processes data across various underground channels, revealing an active market for PHP based web shells bundled with cPanel and Remote Desktop Protocol access, freque

Malware authors frequently leverage script-based formats like PowerShell and VBScript to slip past traditional signature defenses. Because these tactics rely heavily on layered obfuscation, dynamic execution, and "living off the land" techniques, traditional security tools often struggle to uncover the underlying malicious intent. Google Threat Intelligence addresses this critical defense gap by shifting the security paradigm from simple syntax matching to advanced behavioral mapping and automated script analysis.One of the standout capabilities highlighted in this framework is the capacity for precision searching and intent-driven hunting. Instead of manually parsing lines of randomized variables or multi-layer Base64 encoding, defenders can utilize unique query modifiers. For instance, the system allows analysts to hunt for active indicators like dynamic execution blocks or known credential-stealing patterns using specialized behavioral markers and YARA rules. Searching by intent ena

In an increasingly interconnected world, distributed denial of service (DDoS) attacks have become a preferred mechanism for hacktivist groups seeking to project influence and disrupt critical infrastructure. To help organizations navigate this volatile environment, Google Threat Intelligence has introduced the Hacktivist DDoS Activity Dashboard. This new command center offers a sophisticated approach to tracking, analyzing, and corroborating threat actor claims, moving security teams away from a reactive posture and toward tailored, data-driven defense.The power of this dashboard lies in its comprehensive data integration. Developed by the Google Threat Intelligence Group, the platform combines botnet command and control (C2)  telemetry with continuous harvesting from threat actor Telegram channels. Rather than taking adversary claims at face value, the system utilizes check-host.net data to capture and cross reference indicators, ensuring that security professionals can distinguish ac

In the rapidly evolving world of cybersecurity, traditional defense mechanisms often find themselves one step behind sophisticated adversaries. Legacy antivirus engines rely heavily on static signatures and heuristics to identify threats, a limitation that malicious actors frequently exploit through heavy obfuscation and deceptive naming conventions. When a dangerous file manages to bypass every major security vendor, achieving a zero detection status, security teams are often left vulnerable and without immediate answers.This is precisely where Google Threat Intelligence and its innovative feature, Code Insight, transform the paradigm of threat analysis. Integrated within VirusTotal, Code Insight utilizes generative artificial intelligence to look far beyond surface level indicators. Instead of merely evaluating whether a file matches a database of known malicious signatures, it analyzes the semantic intent of the underlying code. It essentially asks a fundamental question: what is th

Security operations teams frequently face an overwhelming influx of security alerts, many of which turn out to be unrelated to their actual digital infrastructure. Sifting through millions of underground forum posts and leak sites to find genuine risks can exhaust valuable defensive resources. To address this challenge, Google Threat Intelligence has introduced the Relevance System, a feature powered by Gemini AI that aligns global dark web monitoring directly with your unique business profile.The system operates by letting organizations explicitly define their digital landscape. Setting up the profile requires minimal effort, requiring only an organization name and a primary domain to begin. Once initialized, the platform maps key digital assets, such as specific IP ranges, company domains, and brand keywords. It also allows teams to prioritize monitoring for mentions from Initial Access Brokers, data leakers, insider threats, and VIP mentions across underground networks.By understand

In the modern cybersecurity landscape, playing catch-up is no longer an option. Security teams frequently find themselves responding to threats after a breach has occurred, leaving them constantly on the defensive. To truly protect your digital assets, you need deep visibility into where threats originate long before they reach your network perimeter.Historically, monitoring the dark web has been a manual, volatile, and highly fragmented process. Underground sites frequently go offline, and threat actor communications are scattered across encrypted channels. Google Threat Intelligence solves this by archiving and structuring underground data, giving analysts reliable, historical access.Google Threat Intelligence is shifting the paradigm with its new Deep and Dark Web (DDW) Search capabilities. Featured in this #GoogleTIMondays update, this feature indexes, normalizes, and archives dark web data—turning a notoriously chaotic environment into a powerful, searchable asset.Don’t wait for a

As artificial intelligence systems become increasingly autonomous, the cybersecurity landscape undergoes a parallel transformation. The latest insights from Google Threat Intelligence reveal a critical shift from simple prompt manipulations to sophisticated agentic threats. In this modern paradigm, artificial intelligence systems act as both the primary targets and the delivery mechanisms for advanced cyber attacks. Security researchers are observing a notable rise in dynamic threat vectors, including indirect prompt injections and multi-modal exploits designed to undermine organizational security baselines.One primary area of concern involves poisoned skills and tool injection within autonomous workflows. Because large language models rely on modular skills to perform automated tasks, malicious actors have begun poisoning public repositories, such as ClawHub and OpenClaw, with hidden backdoors or info-stealing logic. This effectively turns standard automation processes into a supply c

The cybersecurity landscape is shifting as threat actors evolve past basic AI-generated phishing lures. A recent research brief from Google Threat Intelligence highlights a sophisticated trend: attackers are now integrating Large Language Model (LLM) APIs directly into malware to dynamically generate code, obfuscate payloads, and adapt malicious behavior in real time. This evolution requires security teams to transition from traditional signature matching to analyzing structural artifacts, network behaviors, and API dependencies. According to the research, AI enabled threats primarily follow two architectural paths: edge-hosted and cloud-connected.Edge hosted malware bundles local inference engines, such as Llamafiles, allowing them to operate offline without internet dependencies. Defenders can hunt for these threats by monitoring host file systems for specific behavioral files, including .ollama, .gguf, or .safetensors extensions. Since local models often establish a local web server

In today's fast paced cybersecurity landscape, security operations center (SOC) teams face an overwhelming volume of alerts. To combat analyst fatigue and accelerate incident response times, modern practitioners require actionable context delivered directly into their existing daily tools. The integration of Google Threat Intelligence  with Google SecOps SOAR offers a powerful solution to automate routine tasks and enhance detection fidelity across the entire enterprise.Deploying this integration within your security environment is remarkably straightforward. By navigating to the Technology Integrations marketplace directly within Google SecOps, teams can quickly locate and install the Google Threat Intelligence package, authenticating the environment securely using a dedicated service account API key. Once activated, the integration unlocks automated playbook workflows that eliminate the need for analysts to pivot between different browser tabs or separate tools during a critical inve

Generic intelligence is frequently too broad to provide meaningful defense, leaving security practitioners with the monumental task of manually triaging massive volumes of data. Recognizing this critical bottleneck, Google Threat Intelligence has introduced Country & Industry Profiles. These consolidated, quarterly updated profiles bridge the gap between vast data pools and targeted defense by delivering region- and sector-specific insights directly to security operations teams.A major challenge for busy analysts is the time required to digest dozens of raw reports. To solve this, the platform utilizes Gemini to synthesize proprietary Google findings and open-source intelligence into a single, actionable narrative. For example, the Q1 2026 profiles reveal critical threat drivers, such as sophisticated state-sponsored espionage targeting healthcare sectors via custom malware and financially motivated cybercrime syndicates leveraging voice phishing and remote desktop protocol vulnera

Defending modern enterprise networks requires keeping pace with increasingly sophisticated evasion techniques. In the third installment of the Google Threat Intelligence Mondays series, security professionals are provided with critical insights into Living off the Land Binaries, commonly known as LOLBins. Attackers frequently exploit these legitimate, native Windows utilities to bypass traditional security controls, blend in with standard administrative traffic, and execute malicious payloads undetected.The documentation highlights several high-risk utilities that require rigorous monitoring. For instance, wmic.exe is regularly abused to delete Volume Shadow Copies and hinder system recovery. Similarly, cmstp.exe can be subverted to execute arbitrary scripts via malicious INF files, effectively neutralizing AppLocker and User Account Control restrictions. Other common vectors include leveraging msiexec.exe for silent, remote MSI package installations and utilizing schtasks.exe to estab

Let’s continue diving into hunting LOLBins with Google Threat Intelligence. In our previous post, we discussed Living-off-the-Land Binaries, widely recognized as LOLBins, and how they represent a sophisticated and persistent challenge in modern cybersecurity operations. Due to the fact these utilities are legitimate, preinstalled components of the operating system, malicious actors frequently abuse them to bypass traditional security controls, execute unauthorized code, and blend seamlessly into normal network behavior. Recent findings from Google Threat Intelligence reveal that these tools remain a powerful tool for both espionage and financially motivated cyber campaigns.To protect corporate networks, defenders must actively hunt for the specific behaviors associated with these utilities. For instance, the Windows tool mshta.exe is frequently subverted to execute remote HTML applications via external URLs, bypassing standard browser security. Another common target is regsvr32.exe, wh

Modern cyber adversaries are increasingly avoiding traditional file-based malware, choosing instead to blend seamlessly with normal system operations. This evasive technique, known as Living-off-the-Land Binaries (LOLBins), involves utilizing legitimate, trusted system tools to execute malicious actions while bypassing standard security whitelists. Because these native utilities are already inherently trusted by the operating system, detecting their subversion requires advanced behavioral telemetry rather than relying purely on static indicators.Google Threat Intelligence provides security teams with powerful capabilities to uncover these hidden behaviors. Native applications like PowerShell, Certutil, and Rundll32 are frequently exploited by threat actors. For instance, attackers often misuse PowerShell for fileless execution through encoded commands, or leverage Certutil to retrieve remote payloads and decode malicious files. Similarly, Rundll32 is commonly subverted to execute web-h

Google Threat Intelligence has officially transitioned its agentic artificial intelligence capabilities from public preview to General Availability. Now accessible to all Enterprise and Enterprise+ customers, this development represents a major step forward in scaling cybersecurity expertise, optimizing resource allocation, and streamlining complex security operations across organizations.The core benefit of this feature lies in its ability to seamlessly support the full spectrum of cyber defense functions. Whether your security team is focused on strategic threat hunting, rapid incident response, or daily alert triage, the platform simplifies the entire operational workflow. Security professionals can now utilize intuitive natural language queries to generate comprehensive, up to date threat reports, execute indicators of compromise searches, and analyze suspicious files, domains, or vulnerabilities.One of the standout components of this release is the Prompt Library, which allows org

The modern threat landscape demands analytical tools that can rapidly synthesize massive amounts of data into actionable intelligence. The Google Threat Intelligence - Threat Graph addresses this need by providing security professionals with an advanced, interactive visualization interface designed to map complex relationships across digital infrastructure. By automatically uncovering and illustrating more than 30 distinct interitem links, the tool bridges the gap between disparate technical artifacts such as file properties, localized domain mappings, and network infrastructure.At its core, the platform utilizes intuitive design elements to construct comprehensive threat maps. Individual nodes denote critical entities like files, URLs, and IP addresses, while distinct relationship nodes group complex dependencies such as compressed parents or contacting network infrastructure. Analysts can interact directly with individual elements to reveal tailormade properties, expansion options, a

In the rapidly changing landscape of cybersecurity, relying solely on static indicators of compromise like file hashes and IP addresses is no longer enough. Threat actors can modify these markers in mere seconds to evade detection. However, their underlying Tactics, Techniques, and Procedures (TTPs) remain remarkably consistent across different campaigns. Google Threat Intelligence addresses this reality by allowing security teams to pivot away from transient indicators and focus heavily on these behavioral patterns.During sandbox execution, the platform automatically maps file behavior directly to the MITRE ATT&CK framework. This powerful integration enables analysts to observe adversary behavior dynamically. Security operations teams can locate these visual heat maps at both an individual indicator level through the behavior tab and at a group level within designated collections. This dual approach provides granular technical clarity alongside a broad strategic overview.The strat

In the evolving landscape of cybersecurity, defenders require deeper insights than static file traits to protect networks effectively. Google Threat Intelligence, through its integration with the FLARE team's automated tools, provides a powerful solution known as the Malware Config Extractor. This innovative feature allows security professionals to pull the core intelligence, or the true DNA, from known malware families. Rather than simply identifying a threat, it exposes critical internal details such as command and control (C2) server addresses, encryption keys, and credentials.A notable example of this tool in action involves analyzing families like xred or Agent Tesla. When handling Agent Tesla, a prominent credential stealer targeting keystrokes and clipboard data, analysts can use specialized search modifiers within the platform. By executing targeted queries, engineers can rapidly filter through files to isolate specific infrastructure or exfiltration methods used over a particu

Understanding the intent behind malicious files has historically posed a significant challenge for cybersecurity professionals. The provided documentation highlights how Google Threat Intelligence addresses this challenge by moving beyond static indicators to analyze true malware behavior. Through automated execution across multiple sandboxes such as Zenbox and CAPE Sandbox, the platform detonates malware safely to record critical actions, including registry modifications, network beacons, and dropped files. This deep behavioral analysis allows organizations to pinpoint complex, multi-stage threats like AgentTesla by evaluating their active execution traces rather than relying solely on file hashes.A major highlight of this functionality is the integration of the open-source CAPA tool, which is maintained by the Mandiant FLARE team. This integration bridges the gap between raw data and actionable intelligence by translating complex API calls and execution traces into human-readable cap