Question

A threat hunter forms a hypothesis that an adversary is using DNS TXT record queries for low-and-slow data exfiltration through a single internal host. The hunter wants a YARA-L 2.0 rule that surfaces hosts generating an anomalously high volume of DNS queries with long, high-entropy subdomain labels to a small set of second-level domains within a short window. Which approach best operationalizes this hypothesis in Google SecOps?

Accepted Answer

Use a multi-event rule that groups by principal.hostname over a match window, filters on network.dns.questions.type for TXT, and uses a condition threshold on the count of distinct long/high-entropy query names per registered domain.

Answer

Write a single-event rule matching every DNS event where network.dns.questions.name contains a base64-like substring, with no aggregation or threshold.

Answer

Create a reference list of known-good domains and alert on any DNS query whose domain is not present in that list, ignoring query type and volume.

Answer

Configure a retrohunt that returns all DNS events for the last 90 days sorted by timestamp so an analyst can manually scroll for suspicious patterns.