Question

During a hypothesis-driven hunt, a SecOps threat hunter suspects that an attacker is using a living-off-the-land technique where a legitimate binary spawns processes writing base64-encoded archives to a temp staging directory before exfiltration. The hunter wants a YARA-L rule that surfaces PROCESS_LAUNCH events whose parent binary is common across the fleet but whose combination of command-line arguments plus a subsequent FILE_CREATION into a temp path is rare. Which approach best matches the intent of finding low-prevalence behavior rather than a static IOC?

Accepted Answer

Use a multi-event rule that joins PROCESS_LAUNCH to a following FILE_CREATION on the same principal and host, then apply an outcome/match window with a condition that counts distinct hosts, alerting only when that behavior appears on very few hosts.

Answer

Write a single-event rule matching any process whose command line contains the string 'base64', since encoding always indicates staging activity.

Answer

Create a reference list of known-malicious file hashes and match FILE_CREATION events whose target file hash is in the list.

Answer

Query GTI for the parent binary's hash and alert whenever the binary appears, relying on GTI reputation to flag the staging behavior.