Question

A threat hunter suspects a compromised build server is being used to spray a downloaded implant across the environment. They hypothesize that the malicious loader process spawns an unusually high number of distinct child process names within a short window compared to legitimate build tooling, which typically reuses the same small set of child binaries. Which YARA-L approach best operationalizes this hypothesis into a repeatable detection?

Accepted Answer

Match PROCESS_LAUNCH events, group by the parent process hash within a sliding time window, and use a count of distinct child process file names with a threshold condition to flag high fan-out parents

Answer

Match every PROCESS_LAUNCH event where the parent process is not on a reference list of approved build binaries, alerting on each individual launch

Answer

Match NETWORK_CONNECTION events from the build server and count distinct destination IPs per source host, alerting when the count exceeds a threshold

Answer

Match PROCESS_LAUNCH events and correlate each child process hash against GTI, alerting only when a child hash has a known-bad verdict