add hexnode fp filter

[djlukic]

Summary of the Pull Request

Adding FP filters for events that happen frequently across devices.

Changelog

fix: Uncommon PowerShell Hosts - filter hexnode
fix: Suspicious Non PowerShell WSMAN COM Provider - filter hexnode
fix: Allow Service Access Using Security Descriptor Tampering Via Sc.EXE - filter hexnode
fix: Registry Persistence via Service in Safe Mode - filter hexnode
fix: Potential PowerShell Obfuscation Using Alias Cmdlets - filter legitimate aliases

Example Log Event

I do not have full XML output as some of the events were written to Sysmon that captures a lot of events and gets frequently overwritten.

<EventData>
	<Data Name="MessageNumber">1</Data>
	<Data Name="MessageTotal">1</Data>
	<Data Name="ScriptBlockText">Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue</Data>
	<Data Name="ScriptBlockId">5b00ac71-cfd8-4845-b030-81733172b2c1</Data>
	<Data Name="Path" />
</EventData>

  
<EventData>
	<Data Name="ServiceName">HexnodeAgent</Data>
	<Data Name="ImagePath">&quot;C:\Hexnode\Hexnode Agent\Current\HexnodeAgent.exe&quot;</Data>
	<Data Name="ServiceType">user mode service</Data>
	<Data Name="StartType">auto start</Data>
	<Data Name="AccountName">LocalSystem</Data>
</EventData>

- 
<Event
	xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- 
	<System>
		<Provider Name="PowerShell" />
		<EventID Qualifiers="0">400</EventID>
		<Version>0</Version>
		<Level>4</Level>
		<Task>4</Task>
		<Opcode>0</Opcode>
		<Keywords>0x80000000000000</Keywords>
		<TimeCreated SystemTime="2025-09-22T07:44:05.6075650Z" />
		<EventRecordID>4385</EventRecordID>
		<Correlation />
		<Execution ProcessID="4728" ThreadID="0" />
		<Channel>Windows PowerShell</Channel>
		<Computer>redacted</Computer>
		<Security />
	</System>
- 
	<EventData>
		<Data>Available</Data>
		<Data>None</Data>
		<Data>NewEngineState=Available PreviousEngineState=None SequenceNumber=57 HostName=Default Host HostVersion=5.1.26100.6584 HostId=c3ac5964-9b83-43b1-a9d1-c4534d66c354 HostApplication=C:\Hexnode\Hexnode Agent\Current\HexnodeAgent.exe EngineVersion=5.1.26100.6584 RunspaceId=a18e4460-6178-4463-b39f-7d4af1db70f1 PipelineId= CommandName= CommandType= ScriptName= CommandPath= CommandLine=</Data>
	</EventData>
</Event>

- 
<Event
	xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- 
	<System>
		<Provider Name="PowerShell" />
		<EventID Qualifiers="0">400</EventID>
		<Version>0</Version>
		<Level>4</Level>
		<Task>4</Task>
		<Opcode>0</Opcode>
		<Keywords>0x80000000000000</Keywords>
		<TimeCreated SystemTime="2025-09-21T17:03:34.9703824Z" />
		<EventRecordID>4312</EventRecordID>
		<Correlation />
		<Execution ProcessID="4728" ThreadID="0" />
		<Channel>Windows PowerShell</Channel>
		<Computer>redacted</Computer>
		<Security />
	</System>
- 
	<EventData>
		<Data>Available</Data>
		<Data>None</Data>
		<Data>NewEngineState=Available PreviousEngineState=None SequenceNumber=17 HostName=Default Host HostVersion=5.1.26100.6584 HostId=1c73079a-f064-4bd3-a771-6ea6cf0213a7 HostApplication=C:\Hexnode\Hexnode Agent\Current\HexnodeAgent.exe EngineVersion=5.1.26100.6584 RunspaceId=90761258-5186-4f7b-9472-c649ba1ce0e8 PipelineId= CommandName= CommandType= ScriptName= CommandPath= CommandLine=</Data>
	</EventData>
</Event>

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[djlukic]

Thank you both @swachchhanda000 @phantinuss
For some reason whenever I run test_logsource and test_rules locally I never get these errors.

[Copilot]

Pull Request Overview

This PR adds false positive filters for Hexnode device management agent to reduce noise from legitimate administrative activities across multiple Sigma rules.

• Adds Hexnode agent filters to 5 detection rules to reduce false positives
• Updates modification dates to 2025-09-22 for changed rules
• Includes specific CIM cmdlet alias filters for PowerShell obfuscation detection

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
registry_set_add_load_service_in_safe_mode.yml	Adds Hexnode agent filter for registry safe mode service loading
proc_creation_win_sc_sdset_allow_service_changes.yml	Adds parent process filter for Hexnode when using sc.exe
posh_ps_susp_set_alias.yml	Adds comprehensive CIM cmdlet alias filters and updates condition
posh_pc_wsman_com_provider_no_powershell.yml	Adds Hexnode host application filter for WSMAN COM provider detection
posh_pc_alternate_powershell_hosts.yml	Adds Hexnode host application filter for alternate PowerShell hosts

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

Pull Request Overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

Pull Request Overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}