fix: more rules

Author: swachchhanda000

rules/windows/builtin/security/win_security_susp_failed_logon_reasons.yml

@@ -7,7 +7,7 @@ references:
     - https://twitter.com/SBousseaden/status/1101431884540710913
 author: Florian Roth (Nextron Systems)
 date: 2017-02-19
-modified: 2022-06-29
+modified: 2025-07-18
 tags:
     - attack.persistence
     - attack.defense-evasion
@@ -18,20 +18,28 @@ logsource:
     product: windows
     service: security
 detection:
-    selection:
+    selection_eid:
         EventID:
             - 4625
             - 4776
-        Status:
-            - '0xC0000072'  # User logon to account disabled by administrator
-            - '0xC000006F'  # User logon outside authorized hours
-            - '0xC0000070'  # User logon from unauthorized workstation
-            - '0xC0000413'  # Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine
-            - '0xC000018C'  # The logon request failed because the trust relationship between the primary domain and the trusted domain failed
-            - '0xC000015B'  # The user has not been granted the requested logon type (aka logon right) at this machine
+    selection_status:
+        - Status:
+              - '0xC0000072'  # User logon to account disabled by administrator
+              - '0xC000006F'  # User logon outside authorized hours
+              - '0xC0000070'  # User logon from unauthorized workstation
+              - '0xC0000413'  # Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine
+              - '0xC000018C'  # The logon request failed because the trust relationship between the primary domain and the trusted domain failed
+              - '0xC000015B'  # The user has not been granted the requested logon type (aka logon right) at this machine
+        - SubStatus:
+              - '0xC0000072'  # User logon to account disabled by administrator
+              - '0xC000006F'  # User logon outside authorized hours
+              - '0xC0000070'  # User logon from unauthorized workstation
+              - '0xC0000413'  # Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine
+              - '0xC000018C'  # The logon request failed because the trust relationship between the primary domain and the trusted domain failed
+              - '0xC000015B'  # The user has not been granted the requested logon type (aka logon right) at this machine
     filter:
         SubjectUserSid: 'S-1-0-0'
-    condition: selection and not filter
+    condition: all of selection_* and not filter
 falsepositives:
     - User using a disabled account
 level: medium

rules/windows/powershell/powershell_module/posh_pm_alternate_powershell_hosts.yml

@@ -6,7 +6,7 @@ references:
     - https://threathunterplaybook.com/hunts/windows/190610-PwshAlternateHosts/notebook.html
 author: Roberto Rodriguez @Cyb3rWard0g
 date: 2019-08-11
-modified: 2022-12-13
+modified: 2025-07-18
 tags:
     - attack.execution
     - attack.t1059.001
@@ -28,6 +28,9 @@ detection:
             # In some cases powershell was invoked with inverted slashes
             - '= C:/Windows/System32/WindowsPowerShell/v1.0/powershell'
             - '= C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell'
+            # In some cases \??\C:.. is used
+            - '= \\\?\?\C:Windows\System32\WindowsPowerShell\v1.0\powershell'
+            - '= \\\?\?\C:Windows\SysWOW64\WindowsPowerShell\v1.0\powershell'
     filter_sdiagnhost:
         ContextInfo|contains: '= C:\WINDOWS\System32\sdiagnhost.exe -Embedding' # When MSDT is launched for example
     filter_citrix: