nerdexam
EC-Council

312-50V12 · Question #150

Your company has been receiving regular alerts from its IDS about potential intrusions. On further investigation, you notice that these alerts have been false positives triggered by certain goodware f

The correct answer is A. Writing YARA rules specifically to identify the goodware files triggering false positives. To reduce false positives caused by goodware files triggering IDS alerts, the most effective strategy is to create specific YARA rules that identify these benign files.

Submitted by tunde_lagos· Mar 4, 2026Information Security and Ethical Hacking Overview

Question

Your company has been receiving regular alerts from its IDS about potential intrusions. On further investigation, you notice that these alerts have been false positives triggered by certain goodware files. In response, you are planning to enhance the IDS with YARA rules, reducing these false positives while improving the detection of real threats. Based on the scenario and the principles of YARA and IDS, which of the following strategies would best serve your purpose?

Options

  • AWriting YARA rules specifically to identify the goodware files triggering false positives
  • BImplementing YARA rules that focus solely on known malware signatures
  • CCreating YARA rules to examine only the private database for intrusions
  • DIncorporating YARA rules to detect patterns in all files regardless of their nature

How the community answered

(28 responses)
  • A
    82% (23)
  • B
    4% (1)
  • C
    11% (3)
  • D
    4% (1)

Why each option

To reduce false positives caused by goodware files triggering IDS alerts, the most effective strategy is to create specific YARA rules that identify these benign files.

AWriting YARA rules specifically to identify the goodware files triggering false positivesCorrect

The problem states that false positives are triggered by specific 'goodware files.' Writing YARA rules explicitly for these known goodware files allows the IDS to identify and ignore alerts from them, directly addressing and reducing the false positive rate. This targeted approach prevents legitimate system processes or applications from being flagged as threats, thus improving the IDS's accuracy in detecting real intrusions.

BImplementing YARA rules that focus solely on known malware signatures

Focusing solely on known malware signatures does not address the existing false positives caused by goodware files, as it only adds more detection capabilities without filtering out the current erroneous alerts.

CCreating YARA rules to examine only the private database for intrusions

Restricting YARA rules to a 'private database' is not directly relevant to the stated problem of goodware causing false positives, nor does it necessarily encompass all files that might trigger an IDS.

DIncorporating YARA rules to detect patterns in all files regardless of their nature

Incorporating YARA rules to detect patterns in all files indiscriminately, 'regardless of their nature,' would likely increase the number of alerts, potentially exacerbating the false positive problem rather than reducing it.

Concept tested: YARA rule tuning for false positive reduction/whitelisting

Source: https://yara.readthedocs.io/en/stable/

Topics

#Intrusion Detection System (IDS)#YARA rules#false positives#threat detection

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V12 Practice