[Rule Tuning/Deprecation] Misc Windows Tuning

rules/windows/discovery_signal_unusual_discovery_signal_proc_cmdline.toml → rules/_deprecated/discovery_signal_unusual_discovery_signal_proc_cmdline.toml

@@ -1,7 +1,9 @@
 [metadata]
 creation_date = "2023/09/22"
-maturity = "production"
-updated_date = "2026/01/15"
+deprecation_date = "2026/08/24"
+deprecated_reason = "This rule doesn't have a good enough signal to noise ratio."
+maturity = "deprecated"
+updated_date = "2026/08/24"
 
 [rule]
 author = ["Elastic"]

rules/windows/command_and_control_remote_file_copy_powershell.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/11/30"
 integration = ["endpoint"]
 maturity = "production"
-updated_date = "2026/05/04"
+updated_date = "2026/08/24"
 
 [transform]
 [[transform.osquery]]
@@ -63,7 +63,7 @@ providers = [
 
 [rule]
 author = ["Elastic"]
-description = "Identifies powershell.exe being used to download an executable file from an untrusted remote destination."
+description = "Identifies PowerShell being used to download an executable file from an untrusted remote destination."
 from = "now-9m"
 index = ["logs-endpoint.events.network-*", "logs-endpoint.events.file-*"]
 language = "eql"
@@ -155,7 +155,7 @@ sequence by process.entity_id with maxspan=30s
   /* Filter out NetBIOS/LLMNR-style names (e.g. host, localhost, etc.) */
   dns.question.name regex """.*\.[a-zA-Z]{2,5}"""]
 [file where host.os.type == "windows" and event.type == "creation" and
-  process.name : "powershell.exe" and 
+  process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") and 
   (file.extension : ("exe", "dll", "ps1", "bat", "cmd", "vbs", "vbe", "js", "jse", "wsh", "wsf", "sct", "hta", "cpl", "scr", "pif", "com") or file.Ext.header_bytes : "4d5a*") and
   not file.name : "__PSScriptPolicy*.ps1" and
   not file.path : (

rules/windows/privilege_escalation_unusual_parentchild_relationship.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
 maturity = "production"
-updated_date = "2026/07/06"
+updated_date = "2026/08/24"
 
 [transform]
 [[transform.osquery]]
@@ -155,14 +155,14 @@ process.parent.name != null and process.parent.executable like ("?:\\*", "\\Devi
    (process.name:"SearchIndexer.exe" and not process.parent.name:"services.exe") or
    (process.name:"SearchProtocolHost.exe" and not process.parent.name:("SearchIndexer.exe", "dllhost.exe")) or
    (process.name:"dllhost.exe" and not process.parent.name:("services.exe", "svchost.exe")) or
-   (process.name:"smss.exe" and not process.parent.name:("System", "smss.exe")) or
+   (process.name:"smss.exe" and not process.parent.name:"System") or
    (process.name:"csrss.exe" and not process.parent.name:("smss.exe", "svchost.exe")) or
    (process.name:"wininit.exe" and not process.parent.name:"smss.exe") or
    (process.name:"winlogon.exe" and not process.parent.name:"smss.exe") or
    (process.name:("lsass.exe", "LsaIso.exe") and not process.parent.name:"wininit.exe") or
    (process.name:"LogonUI.exe" and not process.parent.name:("wininit.exe", "winlogon.exe")) or
    (process.name:"services.exe" and not process.parent.name:"wininit.exe") or
-   (process.name:"svchost.exe" and not process.parent.name:("MsMpEng.exe", "services.exe", "svchost.exe")) or
+   (process.name:"svchost.exe" and not process.parent.name:("MsMpEng.exe", "services.exe")) or
    (process.name:"spoolsv.exe" and not process.parent.name:("services.exe", "Workplace Starter.exe")) or
    (process.name:"taskhost.exe" and not process.parent.name:("services.exe", "svchost.exe", "ngentask.exe")) or
    (process.name:"taskhostw.exe" and not process.parent.name:("services.exe", "svchost.exe")) or
@@ -171,11 +171,13 @@ process.parent.name != null and process.parent.executable like ("?:\\*", "\\Devi
    /* suspicious child processes */
    (process.parent.name:("SearchProtocolHost.exe", "taskhost.exe", "csrss.exe") and not process.name:("werfault.exe", "wermgr.exe", "WerFaultSecure.exe", "conhost.exe", "ngentask.exe", "SearchProtocolHost.exe")) or
    (process.parent.name:"autochk.exe" and not process.name:("chkdsk.exe", "doskey.exe", "WerFault.exe")) or
-   (process.parent.name:"smss.exe" and not process.name:("autochk.exe", "smss.exe", "csrss.exe", "wininit.exe", "winlogon.exe", "setupcl.exe", "WerFault.exe", "wpbbin.exe", "PvsVmBoot.exe", "SophosNA.exe", "omnissa-ic-nga.exe", "icarus_rvrt.exe", "poqexec.exe")) or
-   (process.parent.name:"wermgr.exe" and not process.name:("WerFaultSecure.exe", "wermgr.exe", "WerFault.exe") and
+   (process.parent.name:"smss.exe" and not process.name:("autochk.exe", "csrss.exe", "wininit.exe", "winlogon.exe", "setupcl.exe", "WerFault.exe", "wpbbin.exe", "PvsVmBoot.exe", "SophosNA.exe", "omnissa-ic-nga.exe", "vmware-svi-nga.exe", "icarus_rvrt.exe", "poqexec.exe", "QcSkExt*.exe")) or
+   (process.parent.name:"wermgr.exe" and not process.name:("WerFaultSecure.exe", "WerFault.exe") and
      not (process.name:"rundll32.exe" and process.command_line : "*WerConCpl.dll*LaunchErcApp*")) or
-   (process.parent.name:"conhost.exe" and not process.name:("mscorsvw.exe", "wermgr.exe", "WerFault.exe", "WerFaultSecure.exe", "conhost.exe"))
-  )
+   (process.parent.name:"conhost.exe" and not process.name:("mscorsvw.exe", "wermgr.exe", "WerFault.exe", "WerFaultSecure.exe"))
+  ) and
+ /* exclude self-spawns */
+ not startswith~(process.parent.name, process.name)
 '''