Question

During a hypothesis-driven hunt, a SecOps engineer suspects that a signed but rarely-executed binary is being abused to establish command-and-control. The engineer wants a single YARA-L 2.0 rule that surfaces cases where a process that has been observed on 3 or fewer distinct hosts across the enterprise also initiates an outbound network connection to an external IP. Which YARA-L construct combination correctly implements this hunt within one rule?

Accepted Answer

Correlate process launch and network events in the events section on principal.process.command_line, then use a match window with #host_count and a condition of #host_count <= 3 computed via the outcome section counting distinct principal.asset.hostname

Answer

Use a reference list of all known-good binaries in the events section and exclude any process whose hash appears, relying on the list to imply low prevalence without counting hosts

Answer

Write two separate rules — one detecting all outbound connections and one counting process prevalence — and manually cross-reference their alerts in the SIEM dashboard

Answer

Set metadata.event_type to PROCESS_LAUNCH only and use the outcome section to sum network bytes, assuming high byte counts indicate low-prevalence C2 processes