Is it possible to make a Yara-L rule that is detecting off of a specific field in the additional section?
I have data in the UDM field:
additional.fields["entity"].entity_payload.attachments.name = "test.exe"
I do not know how to access data after the fields["entity"] section. The following rule shows what the rule would currently look like.
rule AM_Example_additional_rule {
meta:
author = "amalone"
description = "Sample rule to chat about additional section"
severity = "Medium"
events:
$e.additional.fields["entity"] = /\\.exe$/
condition:
$e
}
From my testing this does not pick up on the data from the logs.
