Question

You maintain a YARA-L single-event rule that detects use of the 'net user /add' command by matching on process command line. It fires reliably, but the SOC reports that roughly 40% of alerts come from three known IT provisioning hosts that legitimately run this command through an automated onboarding script. Leadership wants the automation preserved but the alerts reduced, and asks that the exclusion logic remain visible and version-controlled inside the rule itself. Which change to the rule best meets these requirements?

Accepted Answer

Add a condition clause that excludes events where the principal hostname is one of the three provisioning hosts, referencing a reference list of authorized onboarding hosts in the rule's match/condition logic.

Answer

Create a separate SOAR playbook that auto-closes any alert originating from the three provisioning hosts after the rule fires.

Answer

Lower the rule severity to Low so the noisy alerts stop appearing on the primary triage queue.

Answer

Disable the rule during business hours when the onboarding script typically runs, then re-enable it overnight.