Question

A detection engineer writes a YARA-L multi-event rule to detect credential dumping followed by lateral movement. The rule joins a process-launch event (LSASS access) with a subsequent remote authentication event on the same host, using a `match` window of 5 minutes. During validation against a known incident replay, the rule fails to fire even though both events are present in the data. Analysis of the incident shows the attacker accessed LSASS, then waited roughly 45 minutes before authenticating to a remote host. What is the MOST appropriate fix while keeping false positives controlled?

Accepted Answer

Increase the `match` window to a value that exceeds the observed attacker dwell time (e.g., 1 hour), and retain a specific join key such as the principal hostname to constrain correlation.

Answer

Remove the `match` window entirely so the two events can correlate regardless of the time gap between them.

Answer

Split the rule into two independent single-event rules, one for LSASS access and one for remote authentication, and alert on each separately.

Answer

Keep the 5-minute window but add a `not` condition to detect the absence of authentication within that window.