Merge PR #5654 from @djlukic - add hexnode fp filter

fix: Uncommon PowerShell Hosts - filter hexnode
fix: Suspicious Non PowerShell WSMAN COM Provider - filter hexnode
fix: Allow Service Access Using Security Descriptor Tampering Via Sc.EXE - filter hexnode
fix: Registry Persistence via Service in Safe Mode - filter hexnode
fix: Potential PowerShell Obfuscation Using Alias Cmdlets - filter legitimate cim aliases
---------

Co-authored-by: Swachchhanda Shrawan Poudel <87493836+swachchhanda000@users.noreply.github.com>
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
Co-authored-by: Nasreddine Bencherchali <nasbench@users.noreply.github.com>

Author: 4 people

rules-threat-hunting/windows/powershell/powershell_classic/posh_pc_alternate_powershell_hosts.yml

@@ -9,7 +9,7 @@ references:
     - https://threathunterplaybook.com/hunts/windows/190815-RemoteServiceInstallation/notebook.html
 author: Roberto Rodriguez @Cyb3rWard0g
 date: 2019-08-11
-modified: 2023-12-11
+modified: 2025-10-22
 tags:
     - attack.execution
     - attack.t1059.001
@@ -32,6 +32,8 @@ detection:
             - 'HostApplication=powershell'
     filter_optional_citrix:
         Data|contains: 'Citrix\ConfigSync\ConfigSync.ps1'
+    filter_optional_hexnode:
+        Data|contains: 'HostApplication=C:\Hexnode\Hexnode Agent\Current\HexnodeAgent.exe'
     condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
 falsepositives:
     - Programs using PowerShell directly without invocation of a dedicated interpreter

rules/windows/powershell/powershell_classic/posh_pc_wsman_com_provider_no_powershell.yml

@@ -8,7 +8,7 @@ references:
     - https://github.com/bohops/WSMan-WinRM
 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
 date: 2020-06-24
-modified: 2024-12-27
+modified: 2025-10-22
 tags:
     - attack.execution
     - attack.t1059.001
@@ -32,7 +32,9 @@ detection:
         # Note: Since we're using the raw data field to match. There is no easy way to filter out cases where the "HostApplication" field is null (i.e doesn't exist). We're practically forced to use a regex.
         # If you're already mapping and extracting the field, then obviously use that directly.
         Data|re: 'HostId=[a-zA-Z0-9-]{36}\s+EngineVersion='
-    condition: selection and not 1 of filter_main_*
+    filter_optional_hexnode:
+        Data|contains: 'HostApplication=C:\Hexnode\Hexnode Agent\Current\HexnodeAgent.exe'
+    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
 falsepositives:
     - Unknown
 level: medium

rules/windows/powershell/powershell_script/posh_ps_susp_set_alias.yml

@@ -9,6 +9,7 @@ references:
     - https://github.com/1337Rin/Swag-PSO
 author: frack113
 date: 2023-01-08
+modified: 2025-10-22
 tags:
     - attack.defense-evasion
     - attack.execution
@@ -23,7 +24,21 @@ detection:
         ScriptBlockText|contains:
             - 'Set-Alias '
             - 'New-Alias '
-    condition: selection
+    filter_main_cim:
+        ScriptBlockText:
+            - 'Set-Alias -Name ncms -Value New-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue'
+            - 'Set-Alias -Name gcls -Value Get-CimClass -Option ReadOnly, AllScope -ErrorAction SilentlyContinue'
+            - 'Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue'
+            - 'Set-Alias -Name gcms -Value Get-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue'
+            - 'Set-Alias -Name rcms -Value Remove-cimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue'
+            - 'Set-Alias -Name rcie -Value Register-CimIndicationEvent -Option ReadOnly, AllScope -ErrorAction SilentlyContinue'
+            - 'Set-Alias -Name gcai -Value Get-CimAssociatedInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue'
+            - 'Set-Alias -Name gcim -Value Get-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue'
+            - 'Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue'
+            - 'Set-Alias -Name ncim -Value New-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue'
+            - 'Set-Alias -Name rcim -Value Remove-cimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue'
+            - 'Set-Alias -Name icim -Value Invoke-CimMethod -Option ReadOnly, AllScope -ErrorAction SilentlyContinue'
+    condition: selection and not 1 of filter_main_*
 falsepositives:
     - Unknown
 level: low

rules/windows/process_creation/proc_creation_win_sc_sdset_allow_service_changes.yml

@@ -11,6 +11,7 @@ references:
     - https://learn.microsoft.com/en-us/windows/win32/secauthz/sid-strings
 author: Nasreddine Bencherchali (Nextron Systems)
 date: 2023-02-28
+modified: 2025-10-22
 tags:
     - attack.persistence
     - attack.t1543.003
@@ -32,7 +33,9 @@ detection:
             - ';BA' # Built-in administrators
             - ';SY' # Local system
             - ';WD' # Everyone
-    condition: all of selection_*
+    filter_optional_hexnode:
+        ParentImage: 'C:\Hexnode\Hexnode Agent\Current\HexnodeAgent.exe'
+    condition: all of selection_* and not 1 of filter_optional_*
 falsepositives:
     - Unknown
 level: high

rules/windows/registry/registry_set/registry_set_add_load_service_in_safe_mode.yml

@@ -7,7 +7,7 @@ references:
     - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-34---windows-add-registry-value-to-load-service-in-safe-mode-with-network
 author: frack113
 date: 2022-04-04
-modified: 2025-10-07
+modified: 2025-10-22
 tags:
     - attack.defense-evasion
     - attack.t1564.001
@@ -30,6 +30,14 @@ detection:
         Image|endswith: '\MBAMInstallerService.exe'
         TargetObject|endswith: '\MBAMService\(Default)'
         Details: 'Service'
+    filter_optional_hexnode:
+        Image: 'C:\Hexnode\Hexnode Agent\Current\HexnodeAgent.exe'
+        TargetObject|endswith:
+            - '\Control\SafeBoot\Minimal\Hexnode Updater\(Default)'
+            - '\Control\SafeBoot\Network\Hexnode Updater\(Default)'
+            - '\Control\SafeBoot\Minimal\Hexnode Agent\(Default)'
+            - '\Control\SafeBoot\Network\Hexnode Agent\(Default)'
+        Details: 'Service'
     condition: selection and not 1 of filter_optional_*
 falsepositives:
     - Unknown