Question

A threat hunter in Google SecOps forms a hypothesis that adversaries are abusing a legitimate remote-access tool that was recently deployed enterprise-wide by IT. Because the tool is now common everywhere, simple prevalence counting produces too many results. The hunter wants to surface only the hosts where the tool made an outbound network connection to a destination that appears on fewer than three distinct hosts across the fleet in the last 7 days. Which YARA-L approach best supports this hypothesis-driven hunt?

Accepted Answer

Write a rule with a match section keyed on the destination (IP/domain), join the process event to the network event on principal.hostname, and use a condition that counts distinct hostnames per destination and keeps groups where the count is below 3.

Answer

Write a single-event rule that alerts whenever the remote-access tool's process executes, since any execution of a remote-access tool is inherently suspicious.

Answer

Write a rule that fires when the process hash has never been seen before, relying on first-seen logic for the binary itself.

Answer

Write a rule filtering only on metadata.event_type = NETWORK_CONNECTION without any grouping, then manually review every result in the timeline.