Question

A detection engineer is writing a YARA-L multi-event rule to detect a slow credential-stuffing campaign in which an attacker attempts logins against many accounts from a single source IP over roughly 20 hours. The engineer groups events by principal.ip, counts distinct target.user values, and sets a threshold. During testing over historical data, the rule never fires even though the analyst confirms the activity clearly occurred across an 18-20 hour span. What is the MOST likely cause, and what should the engineer do?

Accepted Answer

The default or configured match window is shorter than the 20-hour campaign dwell time, so events never coalesce into one detection; the engineer should widen the match window (up to the platform's max) to span the full attack duration.

Answer

The rule's match window exceeds the maximum allowed correlation window in YARA-L; the engineer should shorten the window to fit within the 48-hour limit and re-test.

Answer

The distinct count of target.user must be placed in the events section rather than the outcome section; moving it will allow the rule to fire.

Answer

Multi-event rules cannot group by principal.ip; the engineer should switch to a single-event rule and rely on reference lists for correlation.