Question

A threat hunter suspects a data exfiltration campaign in which a compromised internal host uploads large volumes of data through HTTP POST requests to a low-reputation external destination. She wants a YARA-L 2.0 rule that surfaces hosts whose cumulative outbound HTTP POST payload size to a single destination is abnormally large within a short window, while suppressing normal high-volume application traffic. Which rule design approach best supports this hypothesis-driven hunt?

Accepted Answer

Match individual network events where metadata.event_type = "NETWORK_HTTP" and network.http.method = "POST", then use a match window with $host and $dest as match variables and an outcome that sums network.sent_bytes, applying a condition threshold on the aggregated total

Answer

Match each HTTP POST event individually and alert whenever network.sent_bytes on any single request exceeds 1 MB, without a match window or aggregation

Answer

Use a reference list of known-good application domains as the only filter, alerting on every POST request to a domain not on the list regardless of payload size

Answer

Aggregate total bytes across all event types per host over 24 hours and alert when the daily sum exceeds a fixed byte threshold, ignoring destination and HTTP method