Question

A threat hunter at a financial services firm suspects an adversary is using DLL sideloading to run malicious code under the context of legitimate signed executables. In Google SecOps, they want a hypothesis-driven YARA-L rule that surfaces cases where a process whose main executable is validly signed loads a module (DLL) that is unsigned or has an unverified signature, but ONLY when that specific module path has been loaded on fewer than three distinct hosts across the fleet in the last 14 days. Which rule design best satisfies this hypothesis?

Accepted Answer

Match MODULE_LOAD events where the parent process is signed and the loaded module signature is unverified, then use a 14-day outcome aggregation counting distinct principal.hostname per module full_path and emit only when that count is below 3.

Answer

Match every PROCESS_LAUNCH event with an unsigned main executable and alert immediately, relying on the analyst to manually check module prevalence afterward.

Answer

Use a single-event rule that matches any unsigned DLL load without prevalence logic, then rely on a reference list of known-good DLL paths to suppress the noise.

Answer

Write a UDM search that returns all MODULE_LOAD events for the last 14 days sorted by timestamp, and manually scroll to find rare module paths.