Question

During a hunt in Google SecOps, you hypothesize that malware is masquerading as svchost.exe but is being launched by an unexpected parent process. Legitimate svchost.exe on Windows is spawned almost exclusively by services.exe. You want a YARA-L rule that surfaces svchost.exe process launches whose parent is NOT services.exe, but only when that specific parent/child pairing is rare across the fleet over the past 30 days. Which approach best satisfies this hunt while minimizing false positives from occasional legitimate variations?

Accepted Answer

Use a YARA-L rule that matches svchost.exe launches with a non-services.exe parent, and combine it with an outcome that counts distinct hosts and a condition threshold so only low-prevalence parent/child pairings across the 30-day window are surfaced.

Answer

Write a single-event rule that alerts on every svchost.exe launch where the parent process is not services.exe, with no prevalence consideration.

Answer

Build a rule that alerts whenever svchost.exe makes an outbound network connection, ignoring parent process lineage entirely.

Answer

Create a rule matching any process whose image path is not the System32 directory, regardless of process name or parent.