Low Prevalence IOC Hash Detection

Google SecOps@GoogleSecOps

•updated Jun 2, 2025•0•32

This rule detects the creation or launch of processes or files that match known Indicators of Compromise (IOCs) from a MISP instance and exhibit low prevalence (3 or fewer occurrences) over a 10-day rolling period. This combination suggests potentially malicious activity that is not widespread, indicating a targeted attack or early-stage malware.