Question

A detection engineer deployed a YARA-L single-event rule that alerts on any PowerShell execution containing '-enc'. SOC analysts report that roughly 90% of the alerts are legitimate administrative automation from three known jump-host service accounts, but leadership refuses to fully suppress the rule because the same pattern is occasionally abused. The engineer wants to keep visibility on all matches while ensuring analysts only actively triage the anomalous ones. Which approach best accomplishes this within a single YARA-L rule?

Accepted Answer

Keep the match condition broad, but use an `outcome` section to compute a risk_score that is set high only when the principal is NOT in the known-automation reference list, and drive alerting/priority off that score.

Answer

Add the three service accounts to a reference list, use a `not` condition to exclude them entirely, and lower the rule to informational severity.

Answer

Split the logic into a multi-event rule that joins PowerShell executions to logon events so the service accounts are filtered by their source host.

Answer

Delete the rule and rebuild it as a scheduled UDM search that the analysts run manually once per shift to review encoded PowerShell.