Question

A detection engineer maintains a YARA-L single-event rule that flags any use of `certutil.exe` with a URL argument (a known LOLBin download technique). The rule is technically accurate but generates ~300 alerts per day because a legitimate internal patch-management tool uses certutil to fetch signed update manifests from a fixed internal server. The engineer must preserve detection of genuinely suspicious certutil downloads while eliminating the recurring benign noise, and wants the tuning to remain maintainable and self-documenting. Which approach best meets these goals?

Accepted Answer

Add an exclusion condition in the rule that references a maintained reference list of the known internal patch-management server hostnames/URLs, so events matching the benign source are filtered out while all other certutil downloads still alert.

Answer

Disable the rule and rely on the curated detections pack to cover the certutil technique, since custom LOLBin rules are inherently noisy.

Answer

Lower the rule's severity to Informational so the 300 daily alerts stop paging the SOC, leaving the detection logic unchanged.

Answer

Add a hard-coded regex in the selection condition that matches only URLs containing 'malware' or 'evil' keywords to narrow what the rule detects.