Question

A threat hunter suspects that a compromised GCP service account is being used from an unexpected geographic location. In Google SecOps, they want a YARA-L 2.0 rule that flags whenever a service account authenticates from a country that has never been seen for that specific principal within a 30-day baseline. Which YARA-L construct is essential to express this 'first-seen country per principal' logic correctly?

Accepted Answer

Use a match section keyed on the principal (service account) over a 30-day window combined with an outcome aggregation (e.g., array_distinct of login countries) and a condition that isolates principals with a newly appearing country.

Answer

Use an outcome section with a match window and reference-set membership, comparing the current login country against a static allowlist reference list of approved countries.

Answer

Use a single-event rule with no match section, relying on metadata.event_type equal to USER_LOGIN and a regex on the country field to detect anomalies.

Answer

Use a composite detection that joins two separate rules through the SOAR playbook engine, since YARA-L cannot compute prevalence over time.