Rule for Detection Powershell Execution

[J.Lopes279044]

I created a BIOC to detect running processes in PowerShell and I intend to exclude some processes to avoid showing too many false positives, such as: SenseIR.exe and CompatTelRunner.exe.

Cortex XDR 

[susekar]

Hello @J.Lopes279044 ,

Greetings for the day.

To exclude legitimate processes like SenseIR.exe and CompatTelRunner.exe from your custom PowerShell BIOC rule and reduce false positives, you can use one of the following two methods:

Option 1: Create a BIOC Suppression Rule (Recommended):

This is the preferred method because it prevents the detection engine from matching the activity against specific legitimate processes without requiring you to modify the underlying BIOC rule logic.

Steps:

1. Navigate to:
   Settings > Exceptions Configuration > IOC/BIOC Suppression Rules

2. Click +Add Rule and select Create New.

3. In the Scope section, define the criteria for the processes you wish to exclude
   (for example: Process Name is SenseIR.exe or CompatTelRunner.exe).

4. Under BIOC selection, choose Specific BIOC.

5. Search for and select the custom BIOC rule you created for PowerShell.

6. Save the rule to suppress future alerts for these specific processes.

-------------------------------------------

Option 2: Modify the Custom BIOC Rule Logic:

If you prefer to tune the rule itself, you can add exclusion filters directly into the rule definition.

Using the BIOC Builder (GUI):

1. Navigate to:
   Detection Rules > BIOC

2. Locate and edit your custom BIOC.

3. In the Filters section, add a condition to exclude the processes using the Does Not Equal or Not In operators.

Example filter logic:

Process Name != SenseIR.exe

AND Process Name != CompatTelRunner.exe

Using XQL (Query-Based BIOC):

If your BIOC is based on an XQL query, you can add a filter to exclude the specific process image names:

| filter actor_process_image_name not in ("SenseIR.exe", "CompatTelRunner.exe")

Alternatively, using individual “not equal” filters:

| filter actor_process_image_name != "SenseIR.exe"
and actor_process_image_name != "CompatTelRunner.exe"

Additional Best Practices:

• Hash-Based Exclusions:
  If the process names are too common and you are concerned about potential security gaps, consider excluding them by their file hashes (MD5/SHA256) instead of names.

• Restriction Profiles:
  If you intend to use this BIOC for prevention (blocking), ensure it is added to a Restriction Profile and enabled for the appropriate target endpoints.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar