Question

A threat hunter at a financial services firm hypothesizes that a compromised workstation may be beaconing to an attacker-controlled server. They want to build a YARA-L retrohunt rule in Google SecOps that surfaces outbound network connections to external destination IP addresses that have NOT been observed anywhere in the environment during the prior 30 days, so that only genuinely new destinations are flagged. Which approach best satisfies this requirement?

Accepted Answer

Author a YARA-L rule that references a reference list or leverages the prevalence/first-seen enrichment (e.g., matching where the destination IP's first-seen timestamp falls within the rule's evaluation window) to isolate destinations new within the last 30 days.

Answer

Write a YARA-L rule that matches all outbound connections and manually compare each destination IP against a spreadsheet exported from last month's logs.

Answer

Create a single-event YARA-L rule that alerts on every outbound connection to any public IP address regardless of how long the destination has been seen.

Answer

Configure a data retention rule to delete all network events older than 30 days so that any IP appearing in search results is automatically new.