Question

A detection engineer must build a YARA-L multi-event rule that alerts when a user successfully authenticates from a new host but there is NO corresponding successful MFA challenge event for that same user within a 10-minute window. The MFA events and authentication events arrive as separate UDM events sharing the principal.user.userid field. Which YARA-L construct correctly expresses the requirement that the MFA event must be absent?

Accepted Answer

Use two event variables joined on the userid, place both in the condition section, and negate the MFA event variable with the '!' operator (e.g., $auth and not $mfa) within a match window of 10 minutes.

Answer

Include both event variables with a logical AND in the condition and rely on an outcome variable count of MFA events equal to zero, without a match window.

Answer

Write a single-event rule filtering only authentication events and add a regex exclusion for any line containing the string 'mfa_success'.

Answer

Reference the MFA event inside a reference list and exclude any userid found in that list at rule evaluation time.