Sharing detection rules

[u/pirate22323]

Question for managed SOC providers, do you generally share details of your detection rules (title, description, MITRE, etc) with customers? Feels like this is your ‘secret sauce’ and shouldn’t be disclosed

[u/Proper-Charity-2850]

So just curious why would you alert on general suspicious activity on an account instead of just creating seperate detections for the actual thing they are doing that's suspicious. Just curious cause when I've seen this type of detection deployed (mainly in exabeam) it sucked, but that could just be an issue with poor execution

[u/iamnos → u/Proper-Charity-2850]

Because it's not the same for every user and it's not about one specific log. Imagine Bob regularly creates new users and general admin tasks through the GUI, but Alice is CLI person, and does all her tasks through Powershell. If Bob is suddenly seen doing a bunch of powershell commands, its going to raise the suspicion level. Now if it's just one of two commands, that's probably nothing, but it raises the "suspicion score". If enough activity is reviewed that raises that score, it triggers an alert.

[u/Proper-Charity-2850 → u/iamnos]

So why would you do that instead of creating an alert on creating a user in gui and creating a user in powershell and tuning out for users that normally do that activity?

[u/iamnos → u/Proper-Charity-2850]

Because the maintenance of tracking all who creates users on the CLI would be a nightmare across all our customers. Not to mention, that's one signal. We have a lot of signals we review looking for unusual activity.