Question

A detection engineer deployed a YARA-L single-event rule that flags PowerShell execution with the '-ExecutionPolicy Bypass' flag. The rule is generating hundreds of alerts per day, nearly all from a known set of three IT automation service accounts running legitimate deployment scripts. The engineer must reduce false positives without losing visibility into the same behavior when performed by any other account, and wants a solution that is easy to maintain as the automation account list changes. Which approach is the MOST appropriate?

Accepted Answer

Add a condition referencing a reference list of approved automation account names and exclude matches where the principal user is in that list.

Answer

Delete the rule and rely on curated detections, since the built-in content already handles PowerShell abuse.

Answer

Hard-code the three service account names into the rule's match section with a negation for each account.

Answer

Lower the rule's severity to Informational so the alerts stop appearing in the analyst alert queue.