Question

During a hypothesis-driven hunt in Google SecOps, you suspect that a phishing campaign is spawning script interpreters from Office applications. You want to write a YARA-L 2.0 rule that surfaces PROCESS_LAUNCH events where a Microsoft Office binary (e.g., winword.exe, excel.exe) is the parent of a scripting process (e.g., powershell.exe, wscript.exe), but only when that specific parent-child pairing is rare across your fleet. Which approach best fits YARA-L 2.0 to prioritize low-prevalence pairings rather than every match?

Accepted Answer

Match the parent/child process condition in the events section and use an outcome variable that aggregates a count of distinct hosts, then apply a condition threshold to surface pairings seen on few hosts.

Answer

Write a single-event rule with no match section and rely on the SecOps UI to sort results by timestamp, treating the newest events as low prevalence.

Answer

Add every known-good parent-child pair to the rule's events section using negation so only unlisted pairs generate detections, guaranteeing prevalence-based ranking.

Answer

Use a reference list of all powershell.exe launches and join it to winword.exe events, emitting a detection for any match regardless of frequency.