Rules: Create a Exception Correlation

Question

I'm creating a detection rule to identify when Windows logging is disabled. However, I'm running into false positives during normal system shutdowns, since some log-related events are geneorated as part of the shutdown process.

Is there a way to correlate these two events within a 1-hour time window and trigger the rule only if the shutdown event ($e2) does not exist? I'm looking for the best approach to suppress these false positives while still detecting legitimate attempts to disable Windows logging.

cyberdarren · Answer

To create a detection rule matching your requirements, you will want to write a multi-event rule that uses an unbounded condition (a condition where an event is not required to exist, or where its count is equal to 0) . You can find the official documentation on this behavior here .

In your case, you will define the specific criteria for $e1 and $e2 in the events section. You will then join these events by a common attribute like user ID, set your match time window to 1 hour ($user over 1h), and write your condition section using one of the following options:

// Option 1: Negation (Preferred)
$e1 and !$e2

// Option 2: Explicit Count
$e1 and #e2 < 1

You will likely want to use the first example ($e1 and ! $e2), as it is the most common and readable syntax for negating event existence in YARA-L .

Sign up

Login with SSO

Login to the community

Login with SSO