August 4, 2026
The Match Section in Depth
In a YARA-L rule, the match section controls what to group by and how wide the time window is. The match variable you choose fundamentally changes what the rule detects. Grouping by $source_ip answers "which IPs are generating events?" Grouping by $user answers "which users are experiencing events?" Same events, different questions.
You can group by multiple variables: $user, $source_ip over 1h creates one detection per unique user-IP combination.
Time Window Selection
over 5m- Tight windows for high-speed attacks (brute force, scanning)over 1h- General-purpose window for most behavioral rulesover 24h- Wide windows for slow-and-low attacks, but more expensive to evaluate
Choose the shortest window that captures the behavior you care about.
Outcome Functions
| Function | Purpose | Example |
|---|---|---|
count($event) | Total matching events | How many API calls occurred |
count_distinct($var) | Unique values of a placeholder | How many distinct methods were called |
array_distinct($var) | List of unique values | Which specific methods were called |
sum($event.field) | Sum of a numeric field | Total bytes transferred |
min($event.field) | Minimum value | Earliest timestamp in the window |
max($event.field) | Maximum value | Latest timestamp in the window |
Working Rule: Service Account API Reconnaissance
rule detect_service_account_api_recon {
meta:
author = "SecOps Team"
description = "Service account calling unusually many distinct API methods"
severity = "HIGH"
events:
$api.metadata.log_type = "GCP_CLOUDAUDIT"
$api.principal.user.email_addresses = $sa_email
$api.metadata.product_event_type = $method
re.regex($sa_email, `.*gserviceaccount\.com$`)
match:
$sa_email over 1h
outcome:
$method_count = count_distinct($method)
$methods_called = array_distinct($method)
$total_calls = count($api.metadata.id)
condition:
$api and $method_count >= 15
}
The re.regex() function filters to service account emails. The $method placeholder captures each product_event_type, and count_distinct($method) reports how many different API methods were invoked. A legitimate service account typically calls two or three methods repeatedly. Fifteen or more in an hour suggests enumeration.
