What are reference lists used for?

A reference list is a named, reusable collection of values — IP addresses, domains, usernames, file hashes — that can be referenced from YARA-L detection rules and searches, letting an analyst maintain a single, updatable list rather than hardcoding the same set of values inside every rule that needs to check against it.

condition:
  $e.target.ip in %known_bad_ips

Common use cases include maintaining an IP or domain blocklist sourced from threat intelligence, a user allowlist for accounts that should be excluded from a noisy detection, or a set of known-good file hashes to reduce false positives in a rule looking for suspicious executables.

Because a reference list can be updated independently of the rules that use it, changing the underlying values — adding a newly identified malicious IP, removing a decommissioned service account from an allowlist — takes effect for every rule referencing that list immediately, without needing to edit and redeploy each individual rule separately.