Question

A threat hunter suspects a low-and-slow C2 implant is beaconing from an internal host to an external IP roughly every 30 minutes, but with random jitter to evade fixed-interval detection. The hunter wants to write a YARA-L 2.0 rule that flags hosts making a high volume of outbound connections to a single external IP over a long observation period, regardless of the exact timing between connections. Which YARA-L construct is MOST appropriate to express this multi-event, time-bounded aggregation?

Accepted Answer

A single event rule with a `match` section over a wide time window plus an `outcome` count and a `condition` threshold on the number of connections per (host, destination IP) pair

Answer

A single event rule with only a `condition` on one event's metadata, relying on the default 1-minute detection window

Answer

A reference list lookup that statically enumerates every known-bad beaconing IP and matches inbound events

Answer

A UDM search filter alone, since YARA-L cannot aggregate events across a time window