[Rule Tuning/Deprecation] Misc Windows Tuning

[w0rk3r]

Issues

Resolves https://github.com/elastic/ia-trade-team/issues/991

Summary

• Deprecates Unusual Discovery Signal Alert with Unusual Process Command Line
• Fix Remote File Download via PowerShell 2nd process condition
• Excludes self spawn processes from Unusual Parent-Child Relationship

[elastic-vault-github-plugin-prod]

⛔️ Test failed

Results

• ❌ Unusual Discovery Signal Alert with Unusual Process Command Line (kuery)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta
• ❌ Remote File Download via PowerShell (eql)
  • stack_validation_failed: no_alerts - 0 alerts
• ❌ Unusual Parent-Child Relationship (eql)
  • stack_validation_failed: no_alerts - 0 alerts

[elastic-vault-github-plugin-prod]

⛔️ Test failed

Results

• ❌ Unusual Discovery Signal Alert with Unusual Process Command Line (kuery)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta
• ❌ Remote File Download via PowerShell (eql)
  • stack_validation_failed: no_alerts - 0 alerts
• ❌ Unusual Parent-Child Relationship (eql)
  • stack_validation_failed: no_alerts - 0 alerts

[Copilot]

Pull request overview

This PR tunes several Windows-focused detection rules by deprecating a noisy higher-order discovery signal rule, improving PowerShell remote-download coverage, and reducing false positives in the unusual parent/child relationship rule.

Changes:

• Deprecates Unusual Discovery Signal Alert with Unusual Process Command Line by setting maturity = "deprecated" and adding deprecation metadata.
• Expands the PowerShell remote file download sequence to include additional PowerShell hosts (pwsh.exe, powershell_ise.exe) and updates wording in the rule description.
• Updates the unusual parent/child relationship rule’s allow/deny conditions and adds a self-spawn exclusion to reduce noise.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
rules/windows/privilege_escalation_unusual_parentchild_relationship.toml	Updates parent/child allowlists and adds a self-spawn exclusion to reduce false positives.
rules/windows/command_and_control_remote_file_copy_powershell.toml	Broadens PowerShell process coverage for the file-creation stage (and aligns the network stage) and tweaks description text.
rules/_deprecated/discovery_signal_unusual_discovery_signal_proc_cmdline.toml	Marks the rule as deprecated and adds deprecation metadata (deprecation_date, deprecated_reason).

Suppressed comments (1)

rules/_deprecated/discovery_signal_unusual_discovery_signal_proc_cmdline.toml:6

• This rule is being flipped to maturity = "deprecated", but rule.name is still not prefixed with Deprecated - (and the investigation guide header also uses the non-deprecated name). Deprecation guidelines expect the name to already be marked as deprecated by the time maturity is set to deprecated, so please prepend the prefix for consistency and clarity in UI/search.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[terrancedejesus]

Suggested change

	process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") and
	process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe", "pwsh-preview.exe") and

https://powershellisfun.com/2026/05/01/powershell-preview-v7-7-0-preview-1-release/