Question

During a hypothesis-driven hunt, you suspect adversaries are abusing living-off-the-land binaries (LOLBins) on Windows endpoints in your Google SecOps environment. Specifically, you want to surface cases where a legitimate signed binary (rundll32.exe) is spawned by an unusual parent process such as a Microsoft Office application. Rather than a single point-in-time UDM search, you want a reusable YARA-L rule that continuously evaluates process-launch telemetry for this parent-child relationship. Which approach best satisfies the hunt requirement?

Accepted Answer

Write a YARA-L single-event rule matching PROCESS_LAUNCH events where principal.process.file.full_path ends with rundll32.exe and the parent process (target/principal parent) matches winword.exe, excel.exe, or powerpnt.exe, then deploy it as a detection rule.

Answer

Run a one-time UDM search filtering metadata.event_type = PROCESS_LAUNCH and export the results to a reference list for later manual review.

Answer

Create a YARA-L rule that only matches on the file hash of rundll32.exe, since hash matching is the most reliable way to detect LOLBin abuse.

Answer

Configure a GTI IOC feed subscription for rundll32.exe so SecOps automatically alerts whenever the binary executes anywhere in the environment.