Protocol buffers, while not inherently malicious, is often used by malware because it makes implementing C2 protocols easy.

https://developers.google.com/protocol-buffers

rule golang_protobuf
{
	meta:
		description = "Golang binary with Google protobuf package"

	strings:
		$ = "google.golang.org/protobuf"

	condition:
		all of them
}

YARA Rules Index