Your LSASS handle-access hunt returns 30,000 benign rows — why is that fine in a hunt but not a rule?

## Two different economics, not two different tolerances People describe this as a hunt having a "higher noise tolerance", which makes it sound like sloppiness. It is not a tolerance, it is a different cost structure. A hunt result is consumed **once, in aggregate, by a person who already holds the context**. I ran the sweep, I know what the technique is, I know which procedure each row corresponds to, and I am looking at all of the rows at the same time. That last part is what makes bulk noise cheap: with the whole set in front of me I can group by source image and see immediately that 29,600 of the 30,000 rows come from four pieces of software the estate is supposed to be running. Four exclusions, applied to this sweep only, and the tail I actually read is small. The marginal cost of a benign row is a row. A standing rule is consumed **one firing at a time, by whoever is on shift, forever, without context**. They did not choose the query, they are holding other work, and they must reach a verdict on this one event in isolation. The marginal cost of a benign firing is a whole triage, and it is charged to a different person than the one who wrote the rule. Multiply by every occurrence for as long as the rule exists. That asymmetry — bulk-and-once versus one-at-a-time-and-forever, self-served versus charged to someone else — is the entire answer, and it explains why the same logical predicate can be excellent as a hunt and unshippable as a detection. ## How you actually work a noisy result set The practical technique is to attack the volume before reading anything. Aggregate by the fields that carry legitimacy — source image, signing status, source user, host role — and read the counts, not the rows. Familiar high-volume sources get excluded for this sweep with a comment saying why. What survives is the interesting shape: a source image seen on two hosts out of nine thousand, a source running as a service account that has no business touching that process, a handle opened at an hour that host is normally idle. Crucially, the exclusions you apply here are **disposable**. They are good enough for one analyst's session because you can see what you excluded and undo it. A rule's exclusions are permanent blind spots that an adversary can deliberately live inside — which is another reason the promotion decision is not automatic. ## Promotion is a decision, and the answer is often no A hunt variant becomes a candidate for a standing rule only when its benign hits are few, *stable*, and attributable to a small enumerable set of sources you can exclude with a predicate that will not rot; and when a team is willing to own the resulting queue. The broadest variant here fails all of that: every endpoint agent, management tool and inventory scanner in a large fleet legitimately opens read handles to the credential process, the set changes whenever the platform team deploys something, and pinning it down would require exclusions so broad an intruder could simply run from inside them. So the right outcome is often that the noisiest variant is **deliberately left in the hunt and never promoted**. That is a considered decision, not a failure. Narrower variants off the same list — an unusual call stack, a specific source image, the dump file's creation — may promote perfectly well, and you can promote those while leaving the broad one where it is. ## Say out loud what is only hunted The failure mode that hurts later is silence. If the variant list is not written down with a *hunted* / *detected* column, the organisation ends up with a coverage map that claims this technique is handled, when what actually exists is a query a human runs when they remember. Someone will make an investment decision on that map. Record which procedures have a standing detection, which are only swept periodically, at what cadence, and by whom — and state that a hunted-only variant means there is no automatic notification if it happens tonight. ## And the null result One more discipline that belongs to the same honesty. If the sweep finds nothing, what you have learned is that the variants you searched for left no trace in the records you searched, over the window you could reach, on the hosts that were reporting. It is not evidence the estate is clean. Telemetry gaps, variants absent from your list, and hosts that stopped shipping records all produce exactly the same empty result set as an uncompromised fleet. Report the finding with its scope attached, and treat any host that produced *no* records at all across the window as a finding of its own.