Question

A detection engineer writes a YARA-L single-event rule to catch execution of a renamed 'mimikatz.exe' binary. The rule matches on $e.target.process.file.full_path, but the team observes that the tool is often dropped with mixed-case names like 'MimiKatz.exe' and 'MIMIKATZ.EXE', and the current rule misses these variants. The engineer also wants to avoid false positives from a legitimate internal utility named 'mimic_katalog.exe'. Which change best addresses both goals?

Accepted Answer

Use a case-insensitive regex with anchored word boundaries, e.g. re.regex($e.target.process.file.full_path, `(?i)\mimikatz\.exe$`)

Answer

Add multiple literal equality checks joined with 'or' for each observed casing variant of the filename

Answer

Match with re.regex($e.target.process.file.full_path, `(?i)mimikatz`) to catch every casing and any surrounding characters

Answer

Convert the field with strings.to_lower() and compare it to the literal 'mimikatz' substring