Here is how we combine Chronicle YARA-L correlation with Gemini SecOps to solve a tricky detection challenge:
- What the rule captures in Chronicle: We watch for a single user account accessing Workday from at least two completely different external networks (ASNs) and IP addresses within 30 minutes, while presenting the exact same desktop browser User-Agent.
- The underlying threat behavior: In Account Takeover (ATO) campaigns targeting payroll and HR systems, attackers rotate external proxies and commercial VPS nodes to evade IP-based rate limiting and geo-blocking. Because the attacker operates the same browser or automated script across those hops, their User-Agent fingerprint remains static while their IP and ASN change.
- Feeding distilled telemetry to Gemini: Chronicle YARA-L handles the heavy temporal matching across millions of events. Instead of dumping raw logs into an LLM, YARA-L distills the session into concise outcome variables: the distinct list of ASNs, network carrier names, IPs, and boolean flags showing whether the user only viewed information (like payslips and tax documents) or actually attempted to edit direct deposit routing details (Payment Elections).
- How Gemini applies contextual reasoning: Gemini receives those pre-aggregated variables and performs the semantic evaluation that static SIEM logic cannot:
- Network Classification: It classifies the ASNs and carriers on the fly—distinguishing between commercial VPS/hosting proxies (e.g., Linode, OVH, DigitalFyre), residential broadband (e.g., Comcast, Spectrum), and cellular networks (e.g., Verizon Wireless, AT&T Mobility).
- Evaluating Behavioral Intent: It compares the infrastructure type against what the user actually did. Proxy hopping combined with a WRITE to direct deposit is evaluated as Malicious. Proxy hopping that only does read-only payslip viewing (typical of an employee applying for an apartment or loan via apps like Plaid or Argyle) is evaluated as Suspicious. Switching between home Wi-Fi and a mobile phone hotspot while browsing normally is evaluated as Benign.
- Emitting a Clear Verdict: Gemini outputs a structured verdict (Benign, Suspicious, or Malicious) and an explanation, giving analysts an immediate, clear summary of what happened.
Why Traditional SIEM Rules Struggle Here
If you build this as a standard threshold rule (e.g., alert if a user hits 2 ASNs in 30 minutes and touches Workday), you run into two major false-positive traps:
- Mobile Hotspots: Remote and hybrid employees constantly switch between home Wi-Fi and mobile phone cellular hotspots. This triggers multi-ASN rules all day.
- 3rd-Party Verification Scrapers: When employees apply for an apartment or auto loan, third-party verification platforms (such as Plaid, Argyle, or rental verification tools) spin up cloud scrapers that log in on the user's behalf to read pay stubs.
- The Visiting vs. Mutating Logging Nuance: In Workday user activity logs, merely browsing to an editable form logs the task name (like Payment Elections or Edit Personal Information) as a READ action, even when zero data was altered.
If your rule alerts on every read, your analysts drown in false positives. If you only alert after bank details have already been modified (WRITE), you miss the attacker's initial reconnaissance phase.
Pairing YARA-L with inline Gemini gives us the best of both worlds: deterministic correlation to catch the network pattern, and intelligent triage to evaluate intent.
The Sanitized Chronicle YARA-L Rule
(Note: DataTables your_subnets and your_asns represent your organization's public IP egress and corporate ASNs).
rule workday_rapid_network_rotation_static_useragent {
meta:
author = "Detection Engineering"
description = "Detects rapid cross-ASN external network rotation targeting Workday where the same user account authenticates across multiple distinct external ASNs within 30 minutes while presenting an identical static desktop User-Agent string."
reference = "https://attack.mitre.org/techniques/T1078/004/; https://attack.mitre.org/techniques/T1090/003/"
tags = "attack.initial_access, attack.t1078.004, attack.defense_evasion, attack.t1090.003, attack.persistence, attack.t1098, workday, ato, proxy_rotation"
severity = "High"
dataTables = "your_subnets, your_asns"
rule_category = "Behavioral"
events:
$e.metadata.vendor_name = "Workday"
$e.principal.user.userid != ""
$e.principal.user.userid = $user
$e.principal.ip != ""
$e.principal.network.http.user_agent != ""
$e.principal.network.http.user_agent = $userAgent
$e.principal.ip_geo_artifact.network.asn != ""
// Exclude RFC 1918 private and loopback address space
not net.ip_in_range_cidr($e.principal.ip, "10.0.0.0/8")
not net.ip_in_range_cidr($e.principal.ip, "172.16.0.0/12")
not net.ip_in_range_cidr($e.principal.ip, "192.168.0.0/16")
not net.ip_in_range_cidr($e.principal.ip, "127.0.0.0/8")
// Exclude authorized corporate public IP CIDRs and corporate egress ASNs
not $e.principal.ip in cidr %your_subnets.cidr
not $e.principal.ip_geo_artifact.network.asn in %your_asns.asn
// Desktop OS requirement and mobile device suppression
$userAgent = /Windows NT|Macintosh/ nocase
not $userAgent = /iPhone|Android|Mobile|iPad/ nocase
match:
$user, $userAgent over 30m
outcome:
// User & Identity Context
$outcomeUserId = array_distinct($user)
$outcomeUserDisplayName = array_distinct($e.principal.user.user_display_name)
// Network & Cardinality Aggregation
$outcomeDistinctIps = array_distinct($e.principal.ip)
$outcomeIpCount = count_distinct($e.principal.ip)
$outcomeAsn = array_distinct($e.principal.ip_geo_artifact.network.asn)
$outcomeAsnCount = count_distinct($e.principal.ip_geo_artifact.network.asn)
$outcomeCarriers = array_distinct($e.principal.ip_geo_artifact.network.carrier_name)
$outcomeUserAgents = array_distinct($userAgent)
// Activity & Timing
$outcomeTasks = array_distinct($e.metadata.description)
$outcomeProductEventTypes = array_distinct($e.metadata.product_event_type)
$outcomeFirstSeen = min($e.metadata.event_timestamp.seconds)
$outcomeLastSeen = max($e.metadata.event_timestamp.seconds)
// High-Fidelity Boolean Flags (Computed in YARA-L)
$outcomeHasPaymentElections = array_distinct(
if($e.metadata.description = /Payment Elections/ nocase or $e.extracted.fields["taskDisplayName"] = /Payment Elections/ nocase, "true", "false")
)
$outcomeHasTaxDocuments = array_distinct(
if($e.metadata.description = /Tax Document|Create W-2/ nocase or $e.extracted.fields["taskDisplayName"] = /Tax Document|Create W-2/ nocase, "true", "false")
)
$outcomeHasPayslips = array_distinct(
if($e.metadata.description = /Payslip/ nocase or $e.extracted.fields["taskDisplayName"] = /Payslip/ nocase, "true", "false")
)
$outcomeHasWriteActivity = array_distinct(
if($e.metadata.product_event_type = "WRITE" or $e.extracted.fields["activityAction"] = "WRITE", "true", "false")
)
condition:
#e >= 2 and $outcomeAsnCount >= 2 and $outcomeIpCount >= 2
}
The Gemini Prompt Breakdown
Inside the rule metadata, we define a single-line gemini_prompt. Logically, the prompt is organized into four tasks:
1. Variable Review:
We point Gemini directly to the pre-aggregated outcome variables (outcomeAsn, outcomeCarriers, outcomeHasWriteActivity, outcomeHasPaymentElections, outcomeHasPayslips, etc.) so it only consumes relevant facts rather than raw event streams.
2. Infrastructure Classification:
Gemini classifies the observed ASNs and carriers into three buckets:
- Datacenter / VPS / Commercial Proxy: DigitalFyre, OVH, Linode, AWS, hosting providers.
- Residential Broadband: Comcast, Verizon FiOS, Charter Spectrum.
- Cellular / Mobile Network: Verizon Wireless, AT&T Mobility, T-Mobile.
3. Decision Order:
- Rate as Malicious: If an active WRITE occurs on direct deposit (outcomeHasPaymentElections) or user profile data combined with cross-infrastructure proxy rotation.
- Rate as Suspicious: If the session rotates across Datacenter or Residential proxy networks accessing payslips or tax documents, but all activity is strictly READ-only (characteristic of 3rd-party income verification scrapers or initial attacker reconnaissance).
- Rate as Benign: If the rotation involves a Cellular/Mobile network (such as a laptop tethered to a phone) or transitions between consumer residential networks without any sensitive payroll or tax access.
4. Structured Output Contract:
We instruct Gemini to return a clean JSON object with exactly three fields: verdict, explanation, and verdict_explanation.
Example Gemini Output
When the rule triggers on a typical income verification scraper, Gemini evaluates the outcomes and outputs:
verdict: Suspicious
explanation: The user authenticated across a residential ISP (Verizon FiOS) and a datacenter VPS (DigitalFyre) within 12 minutes using an identical Windows desktop User-Agent string. Payslips and tax forms were accessed, but all operations were read-only with no payment election changes.
verdict_explanation: Activity matches the profile of an authorized third-party income verification scraper (such as a mortgage or rental verification platform) or read-only reconnaissance. Recommend confirming whether the user authorized a verification service.
Real-World Triage Comparison
Here is how triage clarity changes across three common enterprise scenarios:
Scenario 1: True Account Takeover
- Observed Activity: 2 distinct ASNs, identical desktop User-Agent, direct deposit modified.
- Gemini Assessment: Malicious
- Analyst Impact: Immediate high-priority focus. Gemini highlights that a commercial hosting VPS was used and that an actual WRITE mutation occurred on payment elections.
Scenario 2: Employee Applying for an Apartment or Loan
- Observed Activity: 2 distinct ASNs, identical desktop User-Agent, payslips viewed.
- Gemini Assessment: Suspicious
- Analyst Impact: Triage time is cut from 15 minutes to 30 seconds. The analyst immediately sees that a scraper accessed payslips but did not touch payment elections or make any modifications, prompting a quick user confirmation rather than a panic escalation.
Scenario 3: Home Wi-Fi to Mobile Phone Hotspot
- Observed Activity: 2 distinct ASNs, identical desktop User-Agent, general Workday navigation.
- Gemini Assessment: Benign
- Analyst Impact: The alert clearly documents that the second ASN is a major cellular carrier and no sensitive tax or payroll pages were accessed, allowing for fast, confident closure.
Key Takeaways for Detection Engineers
- Let YARA-L do math; let Gemini do context: Don't ask an LLM to count events or compare timestamps across raw logs. Use YARA-L for high-throughput temporal matching, and pass pre-aggregated arrays to Gemini for contextual reasoning.
- Abstract logs into intent flags: Distill tricky SaaS logging nuances (like READ vs. WRITE actions) into explicit boolean flags inside YARA-L before the prompt runs.
- Keep exclusions maintainable: Use Chronicle DataTables for corporate public subnets and corporate ASNs so rules remain portable and clutter-free.
How are you integrating Gemini prompts into your Chronicle detection rules? What use cases have helped your team cut through false positives? Let's discuss in the comments!
