Safe Browsing Hash with Long First/Last Seen Delta
This rule identifies process and file creation events where the associated file's SHA256 hash is present in Google Safe Browsing data and has been observed for a duration greater than 7 days (604,800 seconds). This long observation period for a Safe Browsing-flagged hash could indicate persistent malware or a file that has been present on systems for an extended time before being flagged or detected.
YARA-L
