Detect if a log field exists

Hi everyone. 

Recently I'm writing some detection rules in YARA-L for my company. 

I have a rule that simply match the following: 

 

$selection.target.process.file.full_path = /\/bin\/bash/ and not
            (
                $selection.target.ip="127.0.0.1" or
                $selection.target.ip="0.0.0.0"
            )
 
This rule generates a lot of false positives every time the field target.ip is missing. I would like to trigger the rule only when that field exists and it's not equal certain values. 
So.. how can I check the existence of a field in YARA-L?
 
Thanks
1 2 2,889
2 REPLIES 2