Question

A detection engineer is writing a YARA-L single-event rule to flag a process event whose command line references any of a curated set of 40 suspicious flags stored in a reference list. During testing, the rule fires reliably, but the engineer notices the alert only shows a single matched flag even when the command line contains several. Product management asks that the detection instead only fire when the command line contains at least three DISTINCT suspicious flags from the list, and that the count be surfaced in the alert. Which change best achieves this within a single-event rule?

Accepted Answer

Add an outcome variable using a count-distinct aggregation over the matched flag values and add a condition requiring that count to be >= 3.

Answer

Convert the rule to a multi-event rule with a match window and group by principal.process.pid to count separate flag occurrences.

Answer

Change the `in` operator to `all in` so the command line must contain every entry in the reference list before the rule fires.

Answer

Add `repeated` to the condition and set a `--repeated 3` limit so the rule requires three passes over the same event.