Question

A detection engineer is building a YARA-L multi-event rule to detect a credential-dumping-then-lateral-movement pattern: an LSASS access event on a host followed by an outbound SMB connection from the same host to an internal admin share. The initial rule joins both events on principal.hostname and fires whenever both event types appear within the 1-hour match window, but the SOC reports it also fires when the SMB connection precedes the LSASS access (normal admin behavior). Which change to the rule most precisely enforces the intended attack sequence while keeping the multi-event correlation?

Accepted Answer

Add a condition comparing the two events' metadata.event_timestamp.seconds placeholders so the LSASS access timestamp is less than the SMB connection timestamp

Answer

Reduce the match window from 1 hour to 5 minutes so out-of-order events fall outside the correlation window

Answer

Convert the rule to a single-event rule and rely on the LSASS access event alone, adding the SMB share to a reference list

Answer

Add a suppression on the SMB event type so only the LSASS access contributes to the detection count