Question

A threat hunter has a hypothesis that adversaries in their environment are abusing certutil.exe with a URL argument to download second-stage payloads. They want a YARA-L rule that surfaces only the FIRST time each host executes certutil with a URL-like command-line argument within the last 30 days, to avoid alerting on the many benign, repeated certutil invocations already present in the fleet. Which rule design best satisfies this first-seen-per-host hunting requirement?

Accepted Answer

Use a match section keyed on principal.hostname over a 30-day window with an outcome that counts distinct occurrences, then use a condition that keeps only results where the earliest event timestamp falls within the analysis window and the count equals one per host

Answer

Write a single-event rule that fires on every PROCESS_LAUNCH where target.process.file.full_path ends in certutil.exe and command_line contains 'http', with no match section or aggregation

Answer

Create a rule that joins certutil process events against a reference list of known-good URLs and alerts whenever the URL is not present in the list, regardless of prior host history

Answer

Build a rule using a 1-hour sliding window that counts certutil executions per host and alerts when the count exceeds a threshold of 10 within the window