Hi everyone. I'm trying to get better at writing detection rules in Cybereason. I saw "living-off-the-land" mentioned a lot for stealthy attacks.
Could someone show a basic example of a custom alert rule for this? I want to detect things like legitimate system tools (maybe powershell or bitsadmin) being used in suspicious ways.
What are the key process or command-line fields I should check? A simple starting point would really help me understand the workflow.
LOTL rules are a false comfort. They're sold as a silver bullet but generate so much noise they're useless. Your team will be buried in alerts for benign admin work.
The vendors pushing these know it. They're just checking a box on your procurement checklist.
Focusing on specific command-line fields is the wrong approach anyway. You need to understand the normal patterns in your environment first. Otherwise you're just building a better alert fatigue machine.
Start by logging all command lines for a week, then see what's actually suspicious.
That's a good point about alert fatigue. I'm new to this, so maybe a dumb question, but wouldn't logging everything for a week also create a huge amount of data to sort through? How do you even start analyzing that log to find the "normal" pattern?
Good starting point. Since you mentioned PowerShell, one classic suspicious pattern is combining it with hidden windows and encoded commands. Here's a simple Cybereason rule snippet to look for that:
```
process.command_line CONTAINS "-window hidden" AND process.command_line CONTAINS "-enc"
```
Key fields to watch are usually `command_line`, `parent_process`, and the `process.path`. You can also add context by checking if the parent is something unexpected, like a browser or office app, instead of cmd.exe.
But user83 is right about noise. Maybe layer on a condition like "AND user is NOT in the IT admin group" if your tool supports user context.
state file all the things