Adding more FP filters

Author: djordje-binalyze

rules-threat-hunting/windows/powershell/powershell_classic/posh_pc_alternate_powershell_hosts.yml

@@ -9,7 +9,7 @@ references:
     - https://threathunterplaybook.com/hunts/windows/190815-RemoteServiceInstallation/notebook.html
 author: Roberto Rodriguez @Cyb3rWard0g
 date: 2019-08-11
-modified: 2023-12-11
+modified: 2025-09-22
 tags:
     - attack.execution
     - attack.t1059.001
@@ -32,6 +32,8 @@ detection:
             - 'HostApplication=powershell'
     filter_optional_citrix:
         Data|contains: 'Citrix\ConfigSync\ConfigSync.ps1'
+    filter_optional_hexnode:
+        Data|contains: 'HostApplication=C:\Hexnode\Hexnode'
     condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
 falsepositives:
     - Programs using PowerShell directly without invocation of a dedicated interpreter

rules/windows/powershell/powershell_classic/posh_pc_wsman_com_provider_no_powershell.yml

@@ -8,7 +8,7 @@ references:
     - https://github.com/bohops/WSMan-WinRM
 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
 date: 2020-06-24
-modified: 2024-12-27
+modified: 2025-09-22
 tags:
     - attack.execution
     - attack.t1059.001
@@ -32,6 +32,8 @@ detection:
         # Note: Since we're using the raw data field to match. There is no easy way to filter out cases where the "HostApplication" field is null (i.e doesn't exist). We're practically forced to use a regex.
         # If you're already mapping and extracting the field, then obviously use that directly.
         Data|re: 'HostId=[a-zA-Z0-9-]{36}\s+EngineVersion='
+    filter_main_hexnode:
+        Data|contains: 'HostApplication=HostApplication=C:\Hexnode\Hexnode'
     condition: selection and not 1 of filter_main_*
 falsepositives:
     - Unknown

rules/windows/process_creation/proc_creation_win_sc_sdset_allow_service_changes.yml

@@ -11,6 +11,7 @@ references:
     - https://learn.microsoft.com/en-us/windows/win32/secauthz/sid-strings
 author: Nasreddine Bencherchali (Nextron Systems)
 date: 2023-02-28
+modified: 2025-09-22
 tags:
     - attack.persistence
     - attack.t1543.003
@@ -32,7 +33,10 @@ detection:
             - ';BA' # Built-in administrators
             - ';SY' # Local system
             - ';WD' # Everyone
-    condition: all of selection_*
+    filter_optional_hexnode:
+        - ParentImage|endswith: 'Hexnode\Hexnode Agent\Current\HexnodeAgent.exe'
+        - ParentProcessName|endswith: 'Hexnode\Hexnode Agent\Current\HexnodeAgent.exe'
+    condition: all of selection_* and not 1 of filter_optional_*
 falsepositives:
     - Unknown
 level: high

rules/windows/registry/registry_set/registry_set_add_load_service_in_safe_mode.yml

@@ -7,7 +7,7 @@ references:
     - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-34---windows-add-registry-value-to-load-service-in-safe-mode-with-network
 author: frack113
 date: 2022-04-04
-modified: 2024-03-25
+modified: 2025-09-22
 tags:
     - attack.defense-evasion
     - attack.t1564.001
@@ -26,6 +26,8 @@ detection:
         TargetObject|endswith:
             - '\Control\SafeBoot\Minimal\SAVService\(Default)'
             - '\Control\SafeBoot\Network\SAVService\(Default)'
+    filter_optional_hexnode:
+        Image|endswith: 'Hexnode\Hexnode Agent\Current\HexnodeAgent.exe'
     condition: selection and not 1 of filter_optional_*
 falsepositives:
     - Unknown