Question

During a hypothesis-driven hunt, a SecOps engineer suspects that an adversary is using SMB named pipes (e.g., PsExec-style service execution) for lateral movement across Windows hosts. The engineer wants a YARA-L 2.0 rule that surfaces named pipe connections whose pipe name has been observed on only a very small number of distinct hosts across the enterprise over the last 30 days, treating widely-used pipe names as benign noise. Which approach correctly implements this low-prevalence detection logic?

Accepted Answer

Use a match window over the named-pipe UDM events, group by the pipe name, and apply a condition using count_distinct() on principal.hostname with an outcome variable, alerting only when the distinct host count is below a low threshold.

Answer

Write a single-event rule that matches any named-pipe event and relies on Google SecOps to automatically suppress high-prevalence pipe names without any aggregation logic.

Answer

Statically enumerate known-bad pipe names (e.g., \PIPE\psexecsvc) in the rule's condition section and alert on any exact match, ignoring prevalence entirely.

Answer

Use count() on the total number of named-pipe events per host and alert when a single host generates a high volume of pipe connections in the match window.