Skip to main content
Question

Need help with YARA-L rule

  • August 25, 2026
  • 1 reply
  • 21 views

Khushboo14
Forum|alt.badge.img+3

I am attaching a rule below. I need to have an alert when e1 is true or e2 is true but I don't want and alert when we have a combination of e2 and e3 is true. How can i mention then in the rule.

 

rule RULE_PROD_USER_INFORMATION_REGISTRY_ACCESS {

 

meta:
author = "abcd"
description = "Detect access to registry keys containing user/system information while suppressing expected Dell activity"
severity = "LOW"
priority = "LOW"
mitre_tactic = "TA0005"
mitre_technique = "T1112"
case_type = "Anomaly detection"

 

events:
// Original detection event
$e1.principal.hostname = $host
(
$e1.target.registry.registry_key = /Control Panel\\International\\Geo/ or
$e1.principal.process.command_line = /Control Panel\\International\\Geo/ or
$e1.target.registry.registry_key = /SYSTEM\\CurrentControlSet\\Services\\Disk\\Enum/
)
not (
$e1.principal.process.parent_process.file.names = "Dell.TechHub.Diagnostics.SubAgent.exe" nocase or
$e1.principal.process.parent_process.file.names = "Dell.TechHub.Instrumentation.SubAgent.exe" nocase
)
// MDE BIOS registry query
$e2.principal.hostname = $host
$e2.principal.log_type = "MICROSOFT_DEFENDER_FOR_ENDPOINT"
$e2.principal.process.command_line =/HARDWARE\\DESCRIPTION\\System/

 

// Dell Driver launch
$e3.principal.hostname = $host
$e3.metadata.event_type = "PROCESS_LAUNCH"
$e3.principal.process.command_line = /Dell\\drivers/

 

match:
$host over 10m

 

outcome:
$source_ip = array_distinct($e1.principal.ip)
$vendor_name = array_distinct($e1.metadata.vendor_name)
$product_name = array_distinct($e1.metadata.product_name)
$principal_process_command_line =
array_distinct($e1.principal.process.command_line)

 

condition:

 

// Fire on original detection
$e1
// Suppress if Dell activity is observed
and not ($e2 and $e3)
}

1 reply

matt-amastra
Forum|alt.badge.img+1
  • Bronze 1
  • August 25, 2026

Linking my reply to a very similar question in another thread for those who stumble upon this thread first:


Looking at the rules posted between the two different threads, I believe they are two iterations of the same use-case with the one linked above being the more recent iteration. As such, I believe my answer there holds true for this thread as well, but please let me know if there is something special I may have missed  in this thread that requires additional dedicated attention.