Question

A detection engineer is drafting a YARA-L rule to catch a credential-dumping tool that must correlate a process-creation event with a subsequent registry-read event on the SAM hive from the same host within 5 minutes. Their first draft uses a single event variable ($e) with two selection blocks and adds a 'match' section grouping by principal.hostname. The rule fails to compile with an error indicating the match variables are not correlated across events. What is the root cause and the correct fix?

Accepted Answer

A single event variable cannot represent two distinct correlated events; use two event variables (e.g., $e1 and $e2) joined on principal.hostname, then declare a 'match' section with a time window (e.g., over 5m) to correlate them

Answer

The 'match' section must be removed entirely because YARA-L single-event rules automatically correlate events within the default 48-hour window

Answer

The rule needs an 'outcome' section with a $risk_score placeholder to force the compiler to correlate the two selection blocks across time

Answer

The condition should use the 'nocase' modifier on the registry path so the two selection blocks resolve to the same event instance