Question

A detection engineer is writing a YARA-L multi-event rule to detect a credential-dumping tool that reads LSASS memory and then, within roughly 15 minutes, exfiltrates the dump over an outbound connection. During validation against historical data, the rule fires reliably when both events occur close together but misses cases where the LSASS access and the exfiltration are separated by 12 minutes because they happen to straddle the boundary of a fixed 10-minute aggregation window. What is the MOST appropriate change to reliably correlate these two related events?

Accepted Answer

Increase the rule's `match` window to a duration (e.g., over 15m) that covers the expected dwell time between the two correlated events.

Answer

Convert the rule to a single-event rule so that both behaviors are evaluated in the same event and no window is needed.

Answer

Add a `#event.count > 100` threshold in the outcome section to force the rule to aggregate across all fixed windows.

Answer

Remove the `match` section entirely so the rule evaluates each event independently and never misses either behavior.