Question

A detection engineer is maintaining a YARA-L single-event rule that flags process executions matching a curated list of known malicious file hashes derived from a threat intel feed. The list currently holds about 40 hashes hard-coded as a string literal comparison chain in the rule using multiple 'or' conditions. The intel team now delivers roughly 2,000 new hashes weekly and wants the detection updated without editing rule logic each time or triggering a full rule re-approval. Which approach best supports this requirement in Google SecOps?

Accepted Answer

Store the hashes in a reference list and use the 'in' operator in the rule condition to match against it, updating the list contents as the feed changes.

Answer

Expand the existing chain of 'or' equality comparisons in the rule to include all 2,000 hashes and redeploy the rule weekly.

Answer

Encode the hashes into a single large regex alternation and match with re.regex() for performance at scale.

Answer

Create a separate YARA-L rule for each hash so each indicator can be versioned independently.