Question

During a proactive hunt in Google SecOps, a threat hunter suspects adversaries are abusing PowerShell with base64-encoded commands to evade detection. They want to write a YARA-L 2.0 hunting rule that surfaces only encoded PowerShell invocations that are uncommon across the fleet, avoiding the flood of legitimate administrative scripting that uses encoded commands routinely. Which approach within the rule best isolates the low-prevalence, suspicious activity?

Accepted Answer

Match all process events where the command line contains '-enc' or '-EncodedCommand', then use an outcome section with a match window and #count aggregation to keep only command-line values seen on fewer than a small threshold of distinct hosts

Answer

Match every powershell.exe execution and rely on the analyst manually reviewing all results in the UDM search UI after the rule fires

Answer

Filter only on parent process name being explorer.exe, since interactive encoded commands are always the malicious ones

Answer

Use a regex that decodes the base64 payload inside the YARA-L rule and alert whenever the decoded string contains 'Invoke-Expression'