Merge PR #6131 from @Bit-ByteBandit - Update Webshell Detection With Command Line Keywords

update: Webshell Detection With Command Line Keywords - Remove invalid ver.exe binary matches

---------

Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com>

Author: Bit-ByteBandit

rules/windows/process_creation/proc_creation_win_webshell_recon_commands_and_processes.yml

@@ -8,7 +8,7 @@ references:
     - https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild
 author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson
 date: 2017-01-01
-modified: 2024-12-14
+modified: 2026-07-14
 tags:
     - attack.persistence
     - attack.discovery
@@ -85,7 +85,6 @@ detection:
               - '\systeminfo.exe'
               - '\tasklist.exe'
               - '\tracert.exe'
-              - '\ver.exe'
               - '\wevtutil.exe'
               - '\whoami.exe'
         - OriginalFileName:
@@ -101,7 +100,6 @@ detection:
               - 'sysinfo.exe'
               - 'tasklist.exe'
               - 'tracert.exe'
-              - 'ver.exe'
               - 'VSSADMIN.EXE'
               - 'wevtutil.exe'
               - 'whoami.exe'