Question

During a proactive hunt, you want a YARA-L 2.0 rule that surfaces process-launch events where the parent process is svchost.exe but the child process image hash has been observed on fewer than 3 distinct hosts across your fleet within the last 14 days. You have access to a reference list of known-good child hashes. Which rule design most correctly implements this low-prevalence hunt while minimizing false positives?

Accepted Answer

Write a multi-event rule with a match window of 14 days, group by the child process hash, use #host_count = count_distinct($e.principal.hostname), filter parent == svchost.exe and hash not in the reference list, and gate the outcome with a condition of #host_count < 3.

Answer

Use a single-event rule that matches parent svchost.exe and excludes hashes in the known-good reference list, but rely on the analyst to manually verify prevalence after results return.

Answer

Create a rule that counts total events per hash with count() and alerts when the event total is under 3, grouping only by hash without distinct host aggregation.

Answer

Use a detection rule that joins the process events against a data table of NXDOMAIN responses to correlate rare processes with suspicious DNS, ignoring host prevalence entirely.