Question

During a hypothesis-driven hunt, you suspect an attacker is abusing a legitimate service account to run processes with escalated privileges on only a handful of endpoints. You want a YARA-L 2.0 rule that surfaces process launch events where the process runs under SYSTEM integrity but the same process image path has been observed on very few distinct hosts across the fleet in the last 30 days. Which rule design correctly balances the low-prevalence requirement with the privilege-escalation hypothesis?

Accepted Answer

Use a multi-event rule with a match window over 30 days, group by the process image path, apply a condition that counts distinct principal hostnames, and only fire when that distinct host count is below a defined threshold while the integrity level indicates SYSTEM.

Answer

Use a single-event rule that matches only on integrity level = SYSTEM, with no prevalence logic, and rely on the analyst to manually check host counts afterward.

Answer

Use an outcome section to sum the total number of process events per image path and alert whenever that raw event count exceeds a high threshold, since frequently executed binaries are the most suspicious.

Answer

Use a reference list of known-good binary hashes and fire the rule whenever any process hash appears in that list while running as SYSTEM.