Adding more FP filters

Author: djlukic

rules/windows/builtin/bits_client/win_bits_client_new_transfer_saving_susp_extensions.yml

@@ -32,6 +32,8 @@ detection:
         # Typical updates: Chrome, Dropbox etc.
         LocalName|contains: '\AppData\'
         RemoteName|contains: '.com'
+    filter_optional_microsoft:
+        RemoteName|contains: '.microsoft.com'
     condition: selection and not 1 of filter_optional_*
 falsepositives:
     - While the file extensions in question can be suspicious at times. It's best to add filters according to your environment to avoid large amount false positives

rules/windows/builtin/bits_client/win_bits_client_new_transfer_via_uncommon_tld.yml

@@ -26,6 +26,7 @@ detection:
             - 'download.mozilla.org/' # https://download.mozilla.org/?product=firefox-101.0.1-partial-101.0&os=win64&lang=en-US
             - 'cdn.onenote.net/'
             - 'cdn.office.net/'
+            - 'tscdn.m365.static.microsoft'
     condition: selection and not 1 of filter_main_*
 falsepositives:
     - This rule doesn't exclude other known TLDs such as ".org" or ".net". It's recommended to apply additional filters for software and scripts that leverage the BITS service

rules/windows/builtin/code_integrity/win_codeintegrity_attempted_dll_load.yml

@@ -53,6 +53,9 @@ detection:
         FileNameBuffer|endswith: '\MSOXMLMF.DLL'
         # ProcessNameBuffer is AV products
         RequestedPolicy: 7
+    filter_optional_msoffice_2:
+        ProcessNameBuffer|contains: 'Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office'
+        RequestedPolicy: 8
     filter_optional_slack:
         # Example: https://user-images.githubusercontent.com/112784902/197407680-96d4b662-8a59-4289-a483-b24d630ac2a9.png
         # Even though it's the same DLL as the one used in the electron based app filter. We need to do a separate selection due to slack's folder naming convention with the version number :)

rules/windows/process_creation/proc_creation_win_powershell_non_interactive_execution.yml

@@ -26,6 +26,7 @@ detection:
             - ':\Windows\explorer.exe'
             - ':\Windows\System32\CompatTelRunner.exe'
             - ':\Windows\SysWOW64\explorer.exe'
+            - ':\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe'
     filter_main_windows_update:
         ParentImage: ':\$WINDOWS.~BT\Sources\SetupHost.exe' # During Windows updates/upgrades
         # CommandLine: powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';