Browser LabLD-SIGMA-LAB-003Hard
Browser LabLD-SIGMA-LAB-003Hard20 min
Tune a Noisy Detection (Exam)
A Sigma rule for encoded PowerShell fires 180 times a day and the SOC auto-closes it. Determine the benign cause and the disciplined fix — the rule should keep catching attacks, not be deleted. This is the academy's final assessment.
What you will be able to do
- Distinguish a false-positive flood from a real attack.
- Choose a targeted filter over blunting the rule.
Detection EngineeringIncident TriageT1059.001 — PowerShell
Sign in to start this lab.
Sign in