Question

A detection engineer writes a YARA-L single-event rule to catch suspicious PowerShell execution. The intent is: alert when a process is powershell.exe AND either the command line contains '-enc' OR the command line contains 'DownloadString'. The current condition reads: $e.principal.process.file.full_path = /powershell\.exe$ and re.regex($e.target.process.command_line, `-enc`) or re.regex($e.target.process.command_line, `DownloadString`). After deployment, the rule fires on many benign events where the command line merely contains 'DownloadString' from unrelated non-PowerShell processes. What is the root cause and best fix?

Accepted Answer

Boolean operator precedence causes the 'and' to bind before the 'or', so any event matching only the DownloadString regex fires regardless of process; wrap the two regex conditions in parentheses to enforce the intended grouping.

Answer

The regex is case-sensitive; add nocase to both re.regex calls so only true PowerShell events match.

Answer

The rule is missing a match section, so it evaluates across all events; add a match window to correlate the process and command line.

Answer

The full_path regex anchor is wrong; change $ to a broader pattern so powershell.exe is matched on every event.