Question

A detection engineer is writing a YARA-L single-event rule to flag process events where the command line references any host from a suspicious infrastructure list. The UDM event has a repeated field, principal.process.command_line, but the log also populates target.process.command_line as a repeated field carrying multiple parsed argument values. The engineer writes: $e.target.process.command_line = /badhost\.example/ and finds the rule silently fails to match some events that clearly contain the string in one of several argument values. What is the MOST likely cause and correct fix?

Accepted Answer

Repeated fields require an explicit any or all quantifier; without it YARA-L applies default matching semantics that can miss values, so the condition should be written using 'any $e.target.process.command_line = /badhost\.example/'.

Answer

Regex matching is disabled on repeated fields, so the engineer must first flatten the field with a placeholder assignment before comparing.

Answer

The field must be moved into the outcome section because repeated fields can only be evaluated after aggregation, not in the events section.

Answer

Single-event rules cannot reference repeated fields at all; the engineer must convert the rule to a multi-event rule with a match window.