Selections, Fields & Values

What is it?

A selection is a set of field:value criteria that must all match (a logical AND). Value modifiers refine matching: |contains, |startswith, |endswith, |re (regex). Lists under a field mean 'any of'.

Why it matters

The selection is where precision lives. Matching the right fields with the right modifiers is what separates a rule that catches the behaviour from one that matches half the fleet.

Where you see it

`selection: {Image|endswith: '\powershell.exe', CommandLine|contains: '-enc'}` — both must match; a list value `Image|endswith: ['\cmd.exe','\powershell.exe']` matches either.

What normal looks like

Selections keyed on stable, behavioural fields with modifiers that fit (endswith on an image path, contains on a command line).

What suspicious looks like

An equals match on a full path that varies, a missing modifier so 'powershell' never matches 'C:\...\powershell.exe', or too-loose contains that matches everything.

How analysts investigate

For each field pick the modifier that matches how the value varies (endswith for image paths, contains for command-line substrings), and confirm all criteria in a selection are meant to AND together.

Common beginner mistakes

Using an exact match where the value has a variable prefix (the full path).
A |contains so broad it matches benign activity too.

Match the field the right way

  selection:                       (all criteria AND together)
    Image|endswith: '\powershell.exe'   ← path varies, so endswith
    CommandLine|contains: '-enc'         ← substring, so contains
  list = ANY of:
    ParentImage|endswith: ['\WINWORD.EXE','\EXCEL.EXE']

Field:value with the right modifier (endswith/contains) and AND semantics is what makes a selection precise.

Quick check

You want to match powershell.exe regardless of its install path. Best field modifier?

A quick self-check — it doesn't affect your XP or progress.