See if a UDM field contains a substring of another UDM field

[amalone341]

Is there any way in Yara-L to check if a UDM field contains a substring of another UDM field? The following example shows a use case for this and the question I am trying to ask of the data:

rule variable_testing {

meta:

  author = "amalone"

  description = "Test to see if we can find a substring of one UDM field inside another udm field"  

  severity = "Low"

events:

  $file.metadata.event_type = "FILE_MODIFICATION"

  $file.principal.hostname = $hst

  // Get the name of the file involved in the file modification

  $fileName = re.capture($file.target.file.full_path, `(?:\\|\/)([^\/\\]+)$`)

  $launch.metadata.event_type = "PROCESS_LAUNCH"

  $launch.principal.hostname = $hst

   /*

   Is it possible to see if a UDM field contains a substring of another UDM field? For example, I have a file modification where I grab the name

   of the file using the re.capture function. I want to match this event with a process launch event on the same host where the target.proccess.command_line

   contains the name of the file from the file modifcation. The following two lines are syntactically incorrect but demonstrate the idea of what im trying to accomplish.

   //re.regex($launch.target.process.command_line, $fileName)

   //re.regex($launch.target.process.command_line, re.capture($event.target.file.full_path, `(?:\\|\/)([^\/\\]+)$`) ) nocase

    */

match:

  $hst over 1m

outcome:

 $name = array_distinct($fileName)

condition:

  $file and $launch

}