YARA-L Rule Using External List

[Cyber_Chief1999]

Hi, 

My reading suggests otherwise but wanted to ask on here whether anyone had successfully managed to create a rule that looks up an external list i.e an external URL which holds a list of known Cobalt Strike IP addresses. My reading suggests this is only possible via using the lists method and therefore pointing to an internally managed list (which i have used in some use cases). But for dynamic lists held by a 3rd party/vendor that update frequently, it would be easier for a Cobalt Strike IOC detection rule to point at the external list instead of an internal.

Any help or advice would be appreciated.

Thanks