To identify repeated suspicious file downloads within a defined time window, which approach should you implement?

• A. Flag the highest risk score for a single event
• B. Create a frequency-based YARA-L rule that triggers when multiple suspicious downloads occur within a time frame
• C. Configure a single-event YARA-L rule for many files within 24 hours
• D. Enable default curated detections and automatic alerting for single download events

Answer: (B)

Detecting repeated suspicious downloads within a defined time window relies on correlating events over time and applying a threshold, so the system fires when activity crosses that windowed limit rather than on a single occurrence. A frequency-based YARA-L rule does exactly this: it watches for how many suspicious downloads happen within the specified interval and triggers when the count meets or exceeds the threshold. This approach captures bursts of malicious activity that single-event detections miss, giving you visibility into repeated behavior that indicates a higher likelihood of compromise.

Focusing on a single event and high risk score, or applying a rule to many files within a 24-hour span without tying them together over time, would miss the temporal pattern that defines repeated downloads. Relying on default curated detections and alerts for single download events similarly fails to recognize the correlation across multiple events within the window.