Question

A threat hunter suspects a data-staging operation is exfiltrating to hosts on unusual top-level domains (TLDs) such as .top, .xyz, and .zip. Rather than hardcode a specific list of suspicious TLDs, the hunter wants a YARA-L 2.0 detection that surfaces outbound DNS resolutions to any TLD that is rare across the enterprise over a rolling baseline, so novel TLDs are caught automatically. Which approach best satisfies this hunting goal in Google SecOps?

Accepted Answer

Write a YARA-L rule with an outcome that counts distinct hostnames per TLD using a match window, then use a condition threshold to only surface TLDs seen in a low volume of resolutions relative to the fleet baseline.

Answer

Create a reference list containing every legitimate corporate TLD and write a rule that alerts whenever a resolved domain's TLD is not in the list, ignoring prevalence entirely.

Answer

Build a rule that matches on any DNS event where the query type is A or AAAA, relying on the SecOps risk score to rank which TLDs are anomalous.

Answer

Use a single-event YARA-L rule that regex-matches domains ending in .top, .xyz, or .zip and fires an alert on each match.