Question

A detection engineer wrote a single-event YARA-L rule to flag suspicious `certutil.exe` downloads by matching on `principal.process.command_line`. The rule fires reliably, but the SOC reports it produces intermittent false negatives: some malicious command lines that clearly contain the download flag are not being detected. Investigation shows the missed events used mixed-case flags like `-UrlCache` and `-URLcache`, while the rule uses `re.regex($e.principal.process.command_line, /-urlcache/)`. What is the most correct fix that addresses the root cause without broadening the rule unnecessarily?

Accepted Answer

Add the `nocase` modifier to the regex, e.g. `re.regex($e.principal.process.command_line, /-urlcache/) nocase`, so matching is case-insensitive.

Answer

Replace the regex with a broad substring match on `certutil` alone to guarantee every certutil invocation is captured.

Answer

Convert the rule to a multi-event rule so it can correlate across process events and recover the missed matches.

Answer

Lower the rule's match window so more events fall within scope and reduce the chance of missing matches.