Question

A detection engineer is authoring a YARA-L multi-event rule to detect a process that spawns and then, within a short interval, initiates outbound network activity to a rare destination. During testing over historical data, the rule produces zero matches even though the analyst confirmed a matching process-and-network sequence exists in the dataset. The two UDM events correctly join on principal.hostname and principal.process.pid, and both selection expressions are valid on their own. What is the MOST likely cause of the missing matches that the engineer should investigate first?

Accepted Answer

The rule's match window (over clause) is shorter than the actual time gap between the process-creation event and the network-connection event, so the correlated events fall outside the same window.

Answer

Multi-event rules cannot correlate PROCESS_LAUNCH and NETWORK_CONNECTION event types in a single rule, so a single-event rule is required.

Answer

The join on principal.process.pid is invalid because PID values are only populated on network events, not on process-creation events.

Answer

The rule is missing an outcome section, and YARA-L multi-event rules will not emit detections without at least one outcome variable defined.