Question

A detection engineer is writing a YARA-L multi-event rule to detect credential-stuffing: the same source IP must generate more than 10 failed authentication events against distinct usernames within a 5-minute window. The engineer wants the rule to fire only when the distinct-username count exceeds the threshold. Which construct correctly enforces the 'distinct usernames' aggregation requirement in the rule's condition?

Accepted Answer

Use an outcome variable such as $unique_users = count_distinct($e.principal.user.userid) and require #unique_users > 10 in the condition section

Answer

Use the match section alone to group by $ip, since match automatically deduplicates usernames and enforces the threshold

Answer

Use the placeholder count operator #e > 10 in the condition, which counts distinct usernames because each event has a unique user

Answer

Add a regex filter on $e.principal.user.userid in the events section to ensure usernames differ, then count total events with #e > 10