Question

During a proactive hunt in Google SecOps, you hypothesize that an adversary has established persistence by writing to Windows Registry Run keys on a small number of endpoints. You want a YARA-L 2.0 rule that surfaces registry modifications to Run/RunOnce keys, but only where the resulting binary path is rare across your entire fleet over the last 30 days. Which approach best implements this hunt while minimizing false positives from legitimate, widely-deployed software?

Accepted Answer

Use a rule that matches Run-key registry_value writes, aggregate the distinct count of hostnames per target file path in the match section, and use a condition/outcome that only surfaces paths seen on a low number of hosts across the 30-day window.

Answer

Write a single-event rule that matches any registry_value modification where the key path contains a Run key, and alert on every match without prevalence logic.

Answer

Match Run-key writes and join each event against the GTI IOC feed, alerting only when the binary path string appears verbatim in a threat intelligence indicator list.

Answer

Create a rule that alerts on Run-key writes only when the modifying process is signed, since unsigned software is already blocked by endpoint protection.