Question

A detection engineer is building a YARA-L multi-event rule to detect password-spraying against a corporate SSO endpoint. The goal is to alert when a single source IP generates failed authentication events against at least 10 distinct user accounts within a 15-minute window. Early tests fire alerts even when one IP fails repeatedly against the same 2 or 3 accounts (a locked-out user retrying). Which condition construct correctly enforces the intended detection logic?

Accepted Answer

Group events by `$src_ip` in the `match` section and use the condition `#user > 10`, where `$user` is placed in an `outcome` variable using `distinct_count()`

Answer

Use `$user` as a match variable and set the condition to `#event > 10` over a `match` window of 15m

Answer

Match on `$src_ip` over 15m and set the condition to `$event.count >= 10` referencing the raw event total

Answer

Use a single-event rule with a regex that counts distinct usernames in each authentication log line