How would you build, test and maintain a new detection rule, for example for credential dumping from LSASS?

What the interviewer wants to hear

• Understand the technique and the telemetry it creates
• Write the logic, ideally as detection-as-code such as Sigma
• Test with simulated attacks and check false positives against real data
• Document triage steps and map to ATT&CK
• Version control, review and monitor rule performance over time

Model answer

First I study the technique, here ATT&CK T1003.001, and what telemetry it leaves. Tools like Mimikatz or procdump open a handle to lsass.exe with memory read rights, which shows up in Sysmon Event ID 10 (process access) or EDR events, and LSASS dump files may be written to disk. I write the logic in Sigma so it is vendor-neutral and stored in Git, then convert it to SPL or KQL. The rule focuses on suspicious access rights and unusual source processes, with careful exclusions for known security tools. I test it by running Atomic Red Team tests in a lab to confirm it fires, then run it against 30 days of production data to estimate false positives. I attach a short triage guide and severity. After deployment, changes go through pull request review, and I track alert volume and true positive rate, re-testing when tools or the OS change. Enabling LSA protection also reduces the risk itself.

More hard Cybersecurity Analyst questions

• Ransomware is spreading across your network on a Friday night. Walk me through how you would handle it.
• Design a threat hunt to find lateral movement in a Windows Active Directory environment.
• Your CISO wants to move to zero trust. What does that mean in practice and where would you start?
• A developer accidentally pushed AWS access keys to a public GitHub repository two hours ago. How do you respond?
• Several employees fell for an adversary-in-the-middle phishing site that stole their session cookies despite MFA. How do you respond and harden the environment?
• You are building detection for a cloud-first company with a limited SIEM budget. Which log sources do you onboard first and why?
• HR tells you an engineer who just resigned may be taking source code and customer data. How do you investigate fairly and legally?
• A production Linux server is suspected to be compromised and may lead to legal action. How do you collect evidence in a forensically sound way while limiting business impact?
• How would you measure whether a SOC is effective? Which metrics would you use, and what are their pitfalls?