Question

During a hypothesis-driven hunt, a SecOps threat hunter suspects that an attacker has deployed a lightweight reverse shell that opens a listening service on a non-standard high port on a small number of Linux servers, then periodically initiates outbound connections from that same process. The hunter wants to write a YARA-L 2.0 rule that surfaces only processes that both (a) bound a rare listening port not previously seen in the environment and (b) generated outbound network egress, while suppressing common services like ssh and web servers. Which approach best satisfies this hunt within a single YARA-L detection?

Accepted Answer

Correlate two events joined on principal.process.pid and principal.hostname — one matching the listening/bind activity and one matching outbound network egress — then use an outcome variable with a match window and a count of distinct hosts placed against the aggregation to keep only low-prevalence ports.

Answer

Use a single event section matching only NETWORK_CONNECTION events on the suspected port, with a reference list of allowed ports in a 'not' condition, and no aggregation.

Answer

Write a rule with a single match on process launch events for common shell binaries and alert whenever the parent process is not a login shell.

Answer

Ingest the raw firewall logs into a reference list and run a UDM search for any denied outbound connection, then convert the search into a rule with no join.