Question

A threat hunter suspects that a compromised host is exfiltrating data to infrastructure hosted in an autonomous system (ASN) rarely contacted by the organization. UDM network events are enriched with the destination ASN. The hunter wants a YARA-L rule that surfaces outbound connections to ASNs seen for the first time across the entire fleet within the last 24 hours, while suppressing ASNs that have any prior history in the environment. Which approach best implements this hypothesis-driven hunt?

Accepted Answer

Build a reference list of all destination ASNs observed over a 90-day baseline, then write a YARA-L rule that fires when an outbound connection's ASN is NOT present in that reference list.

Answer

Write a YARA-L rule that matches outbound connections and uses an outcome variable to count distinct destination ASNs, alerting only when the per-ASN event count exceeds a high threshold within the match window.

Answer

Write a YARA-L rule with a 24-hour match window that groups by destination ASN and alerts whenever any ASN appears, relying on analysts to manually discard familiar ASNs during triage.

Answer

Configure a UDM search that filters outbound connections to non-RFC1918 IPs and sorts by ASN alphabetically, exporting the results daily for manual review.