A threat hunter suspects a slow-and-low data exfiltration campaign where compromised endpoints each reach out to a distinct staging domain that no other host in the fleet has ever contacted. The hunter wants a YARA-L 2.0 detection that surfaces network connections to domains that are unique to a single host and have never been observed elsewhere in the environment over the past 30 days. Which YARA-L construct is most appropriate to implement this hunt logic?