add hexnode fp filter

rules-threat-hunting/windows/powershell/powershell_classic/posh_pc_alternate_powershell_hosts.yml

@@ -9,7 +9,7 @@ references:
     - https://threathunterplaybook.com/hunts/windows/190815-RemoteServiceInstallation/notebook.html
 author: Roberto Rodriguez @Cyb3rWard0g
 date: 2019-08-11
-modified: 2023-12-11
+modified: 2025-09-22
 tags:
     - attack.execution
     - attack.t1059.001
@@ -32,6 +32,8 @@ detection:
             - 'HostApplication=powershell'
     filter_optional_citrix:
         Data|contains: 'Citrix\ConfigSync\ConfigSync.ps1'
+    filter_optional_hexnode:
+        Data|contains: 'HostApplication=C:\Hexnode\Hexnode'
     condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
 falsepositives:
     - Programs using PowerShell directly without invocation of a dedicated interpreter

rules/windows/powershell/powershell_classic/posh_pc_wsman_com_provider_no_powershell.yml

@@ -8,7 +8,7 @@ references:
     - https://github.com/bohops/WSMan-WinRM
 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
 date: 2020-06-24
-modified: 2024-12-27
+modified: 2025-09-22
 tags:
     - attack.execution
     - attack.t1059.001
@@ -32,6 +32,8 @@ detection:
         # Note: Since we're using the raw data field to match. There is no easy way to filter out cases where the "HostApplication" field is null (i.e doesn't exist). We're practically forced to use a regex.
         # If you're already mapping and extracting the field, then obviously use that directly.
         Data|re: 'HostId=[a-zA-Z0-9-]{36}\s+EngineVersion='
+    filter_main_hexnode:
+        Data|contains: 'HostApplication=C:\Hexnode\Hexnode'
     condition: selection and not 1 of filter_main_*
 falsepositives:
     - Unknown

rules/windows/powershell/powershell_script/posh_ps_susp_set_alias.yml

@@ -9,6 +9,7 @@ references:
     - https://github.com/1337Rin/Swag-PSO
 author: frack113
 date: 2023-01-08
+modified: 2025-09-22
 tags:
     - attack.defense-evasion
     - attack.execution
@@ -23,7 +24,21 @@ detection:
         ScriptBlockText|contains:
             - 'Set-Alias '
             - 'New-Alias '
-    condition: selection
+    filter_main_cim:
+        ScriptBlockText|contains:
+            - ' -Name ncms -Value New-CimSession '
+            - ' -Name gcls -Value Get-CimClass '
+            - ' -Name ncso -Value New-CimSessionOption '
+            - ' -Name gcms -Value Get-CimSession '
+            - ' -Name rcms -Value Remove-cimSession '
+            - ' -Name rcie -Value Register-CimIndicationEvent '
+            - ' -Name gcai -Value Get-CimAssociatedInstance '
+            - ' -Name gcim -Value Get-CimInstance '
+            - ' -Name scim -Value Set-CimInstance '
+            - ' -Name ncim -Value New-CimInstance '
+            - ' -Name rcim -Value Remove-cimInstance '
+            - ' -Name icim -Value Invoke-CimMethod '
+    condition: selection and not 1 of filter_main_*
 falsepositives:
     - Unknown
 level: low

rules/windows/process_creation/proc_creation_win_sc_sdset_allow_service_changes.yml

@@ -11,6 +11,7 @@ references:
     - https://learn.microsoft.com/en-us/windows/win32/secauthz/sid-strings
 author: Nasreddine Bencherchali (Nextron Systems)
 date: 2023-02-28
+modified: 2025-09-22
 tags:
     - attack.persistence
     - attack.t1543.003
@@ -32,7 +33,10 @@ detection:
             - ';BA' # Built-in administrators
             - ';SY' # Local system
             - ';WD' # Everyone
-    condition: all of selection_*
+    filter_optional_hexnode:
+        - ParentImage|endswith: 'Hexnode\Hexnode Agent\Current\HexnodeAgent.exe'
+        - ParentProcessName|endswith: 'Hexnode\Hexnode Agent\Current\HexnodeAgent.exe'
+    condition: all of selection_* and not 1 of filter_optional_*
 falsepositives:
     - Unknown
 level: high

rules/windows/registry/registry_set/registry_set_add_load_service_in_safe_mode.yml

@@ -7,7 +7,7 @@ references:
     - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-34---windows-add-registry-value-to-load-service-in-safe-mode-with-network
 author: frack113
 date: 2022-04-04
-modified: 2024-03-25
+modified: 2025-09-22
 tags:
     - attack.defense-evasion
     - attack.t1564.001
@@ -26,6 +26,8 @@ detection:
         TargetObject|endswith:
             - '\Control\SafeBoot\Minimal\SAVService\(Default)'
             - '\Control\SafeBoot\Network\SAVService\(Default)'
+    filter_optional_hexnode:
+        Image|endswith: 'Hexnode\Hexnode Agent\Current\HexnodeAgent.exe'
     condition: selection and not 1 of filter_optional_*
 falsepositives:
     - Unknown