Question

A threat hunter suspects an adversary is persisting by creating Windows services that point to binaries in unusual directories. They want a YARA-L hunting rule that surfaces service-creation events (UDM event_type SETTING_MODIFICATION with a service target) where the associated binary file path has NEVER been observed running as a service anywhere in the environment during the prior 14 days. Which approach correctly implements this 'first-seen service binary path' hunt in Google SecOps?

Accepted Answer

Use a YARA-L rule with an outcome that references a reference list or aggregated prior-observation set, combined with a match window, and filter to keep only service binary paths absent from the 14-day baseline set.

Answer

Write a single-event YARA-L rule matching any SETTING_MODIFICATION event that creates a service, since every service creation is inherently suspicious and prevalence context is unnecessary.

Answer

Configure a YARA-L rule that counts total service-creation events per host over 14 days and alerts whenever the count exceeds a static threshold of five.

Answer

Rely solely on GTI IOC enrichment to flag the service binary path, matching only paths already present in the curated threat-intelligence feed.