Question

A threat hunter at a financial services firm hypothesizes that an adversary is establishing persistence by creating scheduled tasks that execute rarely-seen binaries. She wants to write a YARA-L rule in Google SecOps that surfaces scheduled-task creation events where the associated executable hash has been observed on very few endpoints across the enterprise over the past 30 days. Which approach best implements this low-prevalence hunt in YARA-L?

Accepted Answer

Match scheduled-task creation events, then use an outcome variable with a count-distinct aggregation over asset hostnames grouped by the process file hash, and filter for hashes seen on a number of hosts below a defined threshold.

Answer

Match scheduled-task creation events and join each one against a static reference list of known-good binary hashes, alerting on any hash present in the list.

Answer

Write a single-event rule that alerts on every scheduled-task creation event, relying on downstream SOAR playbooks to determine prevalence after the alert fires.

Answer

Match scheduled-task creation events and filter only on binaries whose file path is outside standard system directories, ignoring hash prevalence entirely.