FP filters

rules/windows/builtin/security/win_security_codeintegrity_check_failure.yml

@@ -8,7 +8,7 @@ references:
     - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6281
 author: Thomas Patzke
 date: 2019-12-03
-modified: 2023-12-13
+modified: 2025-01-19
 tags:
     - attack.defense-evasion
     - attack.t1027.001
@@ -20,7 +20,15 @@ detection:
         EventID:
             - 5038
             - 6281
-    condition: selection
+    filter_optional_crowdstrike:
+        param1|contains:
+            - '\CSFalconServiceUninstallTool_'
+            - '\Program Files\CrowdStrike\'
+            - '\System32\drivers\CrowdStrike\'
+            - '\Windows\System32\ScriptControl64_'
+    filter_optional_sophos:
+        param1|contains: '\Program Files\Sophos\'
+    condition: selection and not 1 of filter_optional_*
 falsepositives:
     - Disk device errors
 level: informational

rules/windows/powershell/powershell_classic/posh_pc_renamed_powershell.yml

@@ -7,7 +7,7 @@ references:
     - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
 author: Harish Segar, frack113
 date: 2020-06-29
-modified: 2024-12-27
+modified: 2025-01-20
 tags:
     - attack.execution
     - attack.t1059.001
@@ -27,6 +27,8 @@ detection:
             # In some cases powershell was invoked with inverted slashes
             - 'HostApplication=C:/Windows/System32/WindowsPowerShell/v1.0/powershell'
             - 'HostApplication=C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell'
+            - 'HostApplication=C:\\\\WINDOWS\\\\system32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe'
+            - 'HostApplication=C:\\\\WINDOWS\\\\SysWOW64\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe'
     filter_main_host_application_null:
         # Note: Since we're using the raw data field to match. There is no easy way to filter out cases where the "HostApplication" field is null (i.e doesn't exist). We're practically forced to use a regex.
         # If you're already mapping and extracting the field, then obviously use that directly.