IOC-to-Query Generation for Google SecOps (Chronicle) in Uncoder AI

How It Works

1. IOC Extraction from Threat Reports

Uncoder AI automatically parses structured threat reports to extract:

• Domains and subdomains (e.g., mail.zhblz.com, doc.gmail.com.gyehdhhrggdi…)
  
• URLs and paths from phishing and payload delivery servers
  
• Related IPs, hashes, and filenames (seen on the left)
  

This saves significant manual effort compared to copying and normalizing IOCs from multiple sources.

Explore Uncoder AI

2. Auto-Formatted UDM Query Generation

In the right panel, Uncoder AI outputs a Google SecOps-ready query using the UDM field target.hostname, matching the extracted domains:

target.hostname = "docs.google.com.spreadsheets.d.l1p6eeakedbmwteh36vana6hu-glaekssht-boujdk.zhblz.com"

or target.hostname = "mail.zhblz.com"

or target.hostname = "doc.gmail.com.gyehdhhrggdi1323sdnhnsiwvh2uhdqjwdhhfjcjeuejcj.zhblz.com"

These domains are associated with the adversary’s staging infrastructure, phishing pages, or C2 communication endpoints.

This format is immediately usable in Google SecOps Search to:

• Hunt for previous DNS resolutions or network connections
  
• Build detection rules or custom dashboards
  
• Investigate suspected activity based on domain observables

Why It’s Valuable

• Saves Time: No need to manually format IOC lists — domain values are automatically inserted into valid query syntax
  
• Reduces Errors: Proper use of UDM field names ensures compatibility with Chronicle’s detection engine
  
• Actionable Immediately: Security teams can pivot from a threat report to actual telemetry search in seconds
  

Operational Use Cases

Security analysts and threat hunters can use this feature to:

• Detect phishing campaign callbacks tied to fake Google Docs or OWA pages
  
• Monitor traffic to attacker-controlled infrastructure tied to credential thefΩ
  
• Respond to incidents with pre-verified domain matches across endpoint and network logs
  

From clipboard-based payloads to fake login portals, Uncoder AI empowers Google SecOps teams to transform threat intelligence into structured, high-fidelity detections — instantly.

Explore Uncoder AI