Which approach should you take to generate a list of unknown command and control (C2) nodes within 24 hours?

• A. Write a rule in Google SecOps that scans historic network outbound connections against ingested threat intel and run the rule as a retrohunt against the full tenant
• B. Load network records into BigQuery to identify endpoints that are communicating with domains outside three standard deviations of normal
• C. Review Security Health Analytics (SHA) findings in Security Command Center (SCC)
• D. Write a YARA-L rule in Google SecOps that compares network traffic of endpoints to low prevalence domains against recent WHOIS registrations

Answer: (A)

To find unknown C2 nodes quickly, you want to hunt across your historical data using known malicious indicators. Writing a rule in Google SecOps that scans historic outbound connections against ingested threat intel and running it as a retrohunt against the full tenant lets you search all prior network activity at scale. Retrohunt gives you access to the entire data history, not just what’s happening in real time, so endpoints that reached out to known C2 domains or IPs can be surfaced quickly—even if they weren’t flagged earlier. By anchoring the scan to ingested threat intel, you directly target potential C2 communications, producing a precise list of affected endpoints within a 24-hour window. This approach is faster and more reliable for catching known-bad infrastructure connections across the whole environment than waiting for real-time anomalies or relying on configuration checks or domain-based heuristics that may be slower or noisy.