YARA-L rule to loop through specific additional_fields keys

[_K_O]

Hi everyone, 

I'm currently working on a detection which has "additional_fields" for permissions that were added to a user, e.g.:

• $udm.additional.fields["permissions_added_permissionA"]
• $udm.additional.fields["permissions_added_permissionB"]
• $udm.additional.fields["permissions_added_permissionC"]

Each permission will then contain a specific permission type, e.g. Read, Write, Admin, etc. as shown below:

I can create a detection by explicitly extracting each and every field and creating a regex to look for the permission types individually, but that can lead to missed fields either now or in the future if additional ones are added. 

Is there a way to loop through every additional field which starts with "permissions_added" and look for "write" or "admin" permissions?

TIA!