Question

During a proactive hunt in Google SecOps, a threat hunter forms the hypothesis that adversaries are executing malicious binaries that spoof legitimate vendor names to evade casual review. The hunter wants a YARA-L rule that surfaces executables where the digital signature verification status indicates the binary is unsigned or has an invalid signature, yet the file metadata claims to originate from a well-known trusted software publisher. Which YARA-L detection approach best supports this hypothesis?

Accepted Answer

Match process launch events where the file's signature verification is unsigned/invalid while the file's company or product metadata equals a known trusted publisher, then group by file hash to prioritize low-prevalence matches.

Answer

Match all process launch events from the trusted publisher and alert whenever the daily count exceeds a fixed threshold across the fleet.

Answer

Match DNS query events to newly registered domains and correlate them with any process whose name contains the trusted publisher's brand string.

Answer

Match network connection events on non-standard ports and enrich each with the signing certificate thumbprint from the TLS handshake.