Question

A detection engineer is writing a YARA-L multi-event rule to detect a credential-dumping tool being copied to a host and then executed within a short timeframe. The rule uses two event variables: $copy (a file write of the tool) and $exec (a process launch of the same file). The engineer wants the two events to be correlated only when they occur on the same host within 10 minutes of each other. Which combination of YARA-L constructs correctly enforces this correlation?

Accepted Answer

Join the events on a shared placeholder (e.g., $hostname across $copy and $exec) in the events section, and set 'match: $hostname over 10m' in the match section.

Answer

Use a single-event rule with an 'outcome' variable counting file writes, and filter with a condition that limits results to 10 minutes.

Answer

Set 'match: $copy.metadata.event_timestamp over 10m' and rely on the events section without any shared placeholder between $copy and $exec.

Answer

Add both event variables to the condition section with a 'not' operator and specify the timeframe only in the rule's run frequency setting.