Question

During a hypothesis-driven hunt, a SecOps threat hunter suspects a custom C2 implant is beaconing over HTTPS using a hardcoded, non-standard User-Agent string. The hunter wants to write a YARA-L 2.0 rule that surfaces HTTP requests whose User-Agent value appears on only a handful of hosts across the enterprise over a 7-day window, rather than matching a specific known-bad string. Which approach best supports this low-prevalence hunting goal?

Accepted Answer

Use a YARA-L rule with an outcome section that computes count_distinct($principal.hostname) grouped by $network.http.user_agent, then filter with a condition threshold to return only User-Agent values seen on fewer than a defined number of hosts.

Answer

Create a reference list of all known-good User-Agent strings and write a rule that alerts whenever $network.http.user_agent matches any entry in the list.

Answer

Write a single-event YARA-L rule that matches $network.http.user_agent against a regex for a specific implant signature string.

Answer

Configure a GTI IOC feed match on the destination IP addresses and ignore the User-Agent field entirely.