Question

During a hypothesis-driven hunt, your team suspects that a threat actor is rotating C2 infrastructure but reusing the same TLS server stack, which produces a consistent JARM fingerprint. Your GTI research surfaced a specific JARM hash associated with a known Cobalt Strike listener profile. You want to write a YARA-L rule over Google SecOps network telemetry that surfaces any internal host establishing an outbound TLS session whose server JARM fingerprint matches the GTI-provided value, but only when the destination is NOT already on your approved-vendors reference list. Which approach best implements this hunt while keeping it maintainable as GTI updates the indicator set?

Accepted Answer

Match the JARM fingerprint UDM field against entries in a data table populated from the GTI feed, exclude destinations found in the approved-vendors reference list via a 'not' membership check, and emit on match.

Answer

Match network.tls.server.ja3 against the JARM string literal in the rule body, and hardcode approved vendor IPs into the condition using 'not' comparisons.

Answer

Rely on a single-event UDM search each morning for the JARM value, since YARA-L cannot evaluate TLS fingerprint fields or reference lists together.

Answer

Ingest the JARM indicator as an entity graph enrichment only, and let curated detections automatically fire without authoring any rule logic.