Question

A detection engineer is writing a YARA-L multi-event rule to detect password-spraying: a single source IP that produces failed authentication attempts against many distinct user accounts within 10 minutes. The rule must fire once per source IP (not once per failed event) and must count the number of unique usernames targeted. Which combination of YARA-L constructs correctly implements this requirement?

Accepted Answer

Group events on $src_ip using the match section, compute `$user_count = count_distinct($username)` in the outcome section, and require `$user_count > 15` in the condition section with a 10-minute match window.

Answer

Use a single-event rule with a regex on the username field and set the condition to `$e` so it fires on every failed authentication event.

Answer

Group events on $username in the match section and compute `count($src_ip)` in the outcome section so the rule fires once per targeted account.

Answer

Omit the match section entirely and rely on `count_distinct($username)` in the condition section, since the outcome section cannot be referenced in conditions.