Question

During a hypothesis-driven hunt, a SecOps threat hunter suspects that a subset of endpoints has been reconfigured to use an attacker-controlled DNS resolver as part of a DNS-based command-and-control setup. The hunter wants to build a YARA-L 2.0 retrohunt rule that surfaces DNS query events where the responding/queried DNS server IP is one that is rarely used across the enterprise — flagging hosts talking to resolvers outside the organization's small set of sanctioned internal resolvers. Which approach best expresses this hunt hypothesis in YARA-L?

Accepted Answer

Match network.dns events and use a reference list of sanctioned resolver IPs in the condition (e.g., not $dns_server in %sanctioned_resolvers), then group by the resolver IP so only endpoints querying unlisted DNS servers surface.

Answer

Match all network.dns events and set the condition to fire whenever the DNS query count for any host exceeds 1000 in a 24-hour window, regardless of which resolver was contacted.

Answer

Write a rule that matches process launch events for dns.exe and alerts when the parent process is not svchost.exe, since resolver changes always originate from a spawned process.

Answer

Match network.http events and flag any request whose destination port is 53, correlating on the User-Agent string to identify the malicious resolver.