Question

A detection engineer is asked to alert when a single Windows host performs an interactive logon (UDM event_type USER_LOGIN) from a source IP that is not on the corporate allow-list, and the logon is immediately followed by a privilege escalation event on the same host and by the same user within 5 minutes. The engineer must decide how to structure this in YARA-L 2.0. Which rule design correctly satisfies the requirement?

Accepted Answer

A multi-event rule that references two placeholder variables ($login, $priv), correlates them with a shared $host and $user join key, and constrains them using the match section with a 5m window.

Answer

A single-event rule with a condition that checks both event_type = USER_LOGIN and the privilege escalation type in the same event, since both occur on one host.

Answer

Two independent single-event rules, one per event type, relying on the analyst to manually correlate the resulting alerts in the case timeline.

Answer

A multi-event rule that omits the match section and instead uses only an outcome variable to count events across an unbounded time range.