Question

A detection engineer is writing a YARA-L multi-event rule to flag possible data staging. The intent is to detect when a single host both reads from more than 50 distinct sensitive files AND transfers an aggregate volume exceeding 500 MB within the same match window. The engineer wants the condition to evaluate two computed aggregate values against thresholds. Which approach correctly implements this in a YARA-L 2.0 rule?

Accepted Answer

Compute both aggregates as outcome variables (e.g., $distinct_files = count_distinct($file.path) and $total_bytes = sum($bytes)), then reference both in the condition section with the thresholds combined via 'and'.

Answer

Place count_distinct() and sum() directly in the condition section next to the event variable multipliers, since aggregate functions are only valid inside condition.

Answer

Use two separate single-event rules and correlate them later with a reference list, because YARA-L cannot evaluate more than one aggregate per rule.

Answer

Define the thresholds in the events section as filter predicates (e.g., count_distinct($file.path) > 50) so they are applied before aggregation.