Question

A threat hunter in Google SecOps forms a hypothesis that an attacker is staging tools by writing to hidden administrative shares (e.g., \host\C$) on internal servers before lateral movement. The hunter wants a YARA-L 2.0 rule that surfaces only the FIRST time a given source host writes a file to an admin share on any destination host over the trailing 14 days, avoiding alerts on hosts that routinely perform such writes (backup and patch-management systems). Which approach best implements this hunt?

Accepted Answer

Write a multi-event rule that groups admin-share write events by principal.hostname, uses an outcome variable to count distinct destination hosts, and a match window that reflects the 14-day baseline so recurring senders are aggregated rather than flagged as new.

Answer

Use a single-event rule matching any FILE_CREATION to an admin-share path, with no outcome logic, and let analysts triage the raw volume manually.

Answer

Build a rule keying on the file hash of the written payload and alert whenever the hash prevalence across the fleet exceeds 100 occurrences.

Answer

Create a rule that alerts on any inbound SMB authentication to a server, since admin-share access always requires an SMB logon event.