Lists, searches and conditions

Inside one search

The rules of the last lesson, together:

• Conditions under the same search name must all match (AND).
• The values in a list are alternatives: any one is enough (OR).
• The all modifier turns a list into AND: CommandLine|contains|all: ['/create', '/xml'] needs both texts.

A search can also be a list of maps. Each map is an alternative:

selection:
  - Image|endswith: '\schtasks.exe'
  - OriginalFileName: 'schtasks.exe'

This matches the program by its path or by the name written into the file, whichever is present.

Several searches and the condition

detection can hold any number of named searches. The condition combines them with and, or, not and parentheses:

detection:
  selection:
    Image|endswith: '\schtasks.exe'
  filter_office:
    ParentImage|endswith: '\OfficeClickToRun.exe'
  condition: selection and not filter_office

By convention a search that describes the activity is named selection... and one that removes known normal cases is named filter.... The names are free, but readers rely on the convention.

Two shortcuts help when there are many searches:

• 1 of selection_*: at least one search whose name starts with selection_ matches.
• all of selection_*: every such search matches.
• them stands for every search: 1 of them.

Filters are part of the rule

A filter says "this is normal here". It is the place where a rule is most often wrong in the other direction. ParentImage|endswith: '\Integrator.exe' also hides any program an attacker names Integrator.exe, wherever it runs from. The full path is narrower: ParentImage: 'C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe' (a folder that needs administrator rights to write to). Filter on the most specific values you have, and write in the rule why the filter exists. The next lesson measures filters against the logs of a clean Windows 10 machine.