Question

A detection engineer is building a YARA-L single-event rule to detect suspicious use of Windows Management Instrumentation (WMI) for remote execution. The SOC requires that every deployed rule be traceable to MITRE ATT&CK so that coverage reports can be generated automatically from the rule corpus. What is the BEST way to ensure this rule contributes to automated ATT&CK coverage reporting in Google SecOps?

Accepted Answer

Add mitre_technique and mitre_tactic labels to the rule's meta section using the official technique ID (e.g., T1047) and tactic name

Answer

Include the ATT&CK technique name as a comment above the rule's condition block so analysts can read it during triage

Answer

Name the rule file after the technique (e.g., t1047_wmi.yaral) and rely on the filename for coverage parsing

Answer

Store the technique mapping in an external reference list and join it to alerts at detection time