Conditions, Filters & Boolean Logic

What is it?

The condition combines named selections with boolean logic: `selection and not filter`, `1 of selection_*`, `all of them`. A filter is a selection you exclude to remove known-benign matches.

Why it matters

The condition is where a rule becomes precise: 'the behaviour AND NOT the one legitimate case' is how you keep true positives without drowning in false ones.

Where you see it

`condition: selection and not filter_admin` where filter_admin excludes a known service account or signed tool that legitimately does the thing.

What normal looks like

A condition that ANDs the behaviour with a targeted NOT-filter for the documented benign case, keeping the match set tight.

What suspicious looks like

No filter so the rule fires on legitimate admin use, or an over-broad filter that excludes the attack too — both defeat the detection.

How analysts investigate

Read the condition as a sentence: 'the behaviour, and not the known-good exception'. If it lacks the exception you get false positives; if the exception is too broad you get false negatives.

Common beginner mistakes

Building a NOT-filter so broad it also excludes the malicious case.
Forgetting the filter entirely, so the rule floods on legitimate use.

Behaviour AND NOT the exception

  detection:
    selection: { CommandLine|contains: '-enc' }
    filter_admin: { User: 'svc-deploy' }   ← the ONE legit case
    condition: selection and not filter_admin
  precise: fires on -enc EXCEPT the documented admin account

The condition ANDs the behaviour with a targeted NOT-filter to keep true positives without noise.

Quick check

A rule on '-enc' PowerShell fires 200 times a day on a signed deploy account. Best fix?

A quick self-check — it doesn't affect your XP or progress.