Apply suggestions from code review

Author: nasbench

rules-threat-hunting/windows/builtin/appxdeployment_server/win_appxpackaging_server_successful_package_installation.yml

@@ -19,9 +19,7 @@ logsource:
 detection:
     selection:
         EventID: 854
-    filter_optional_x_windowsupdate:
-        Path|contains: 'x-windowsupdate://'
-    condition: selection and not 1 of filter_optional_*
+    condition: selection
 falsepositives:
     - Legitimate MSIX/AppX package installations
 level: low

rules/windows/builtin/bits_client/win_bits_client_new_transfer_via_uncommon_tld.yml

@@ -7,7 +7,7 @@ references:
     - https://twitter.com/malmoeb/status/1535142803075960832
 author: Florian Roth (Nextron Systems)
 date: 2022-06-10
-modified: 2024-12-25
+modified: 2025-02-28
 tags:
     - attack.defense-evasion
     - attack.persistence
@@ -26,7 +26,7 @@ detection:
             - 'download.mozilla.org/' # https://download.mozilla.org/?product=firefox-101.0.1-partial-101.0&os=win64&lang=en-US
             - 'cdn.onenote.net/'
             - 'cdn.office.net/'
-            - 'tscdn.m365.static.microsoft'
+            - 'tscdn.m365.static.microsoft/'
     condition: selection and not 1 of filter_main_*
 falsepositives:
     - This rule doesn't exclude other known TLDs such as ".org" or ".net". It's recommended to apply additional filters for software and scripts that leverage the BITS service

rules/windows/builtin/code_integrity/win_codeintegrity_attempted_dll_load.yml

@@ -11,7 +11,7 @@ references:
     - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
 author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
 date: 2022-01-20
-modified: 2024-12-25
+modified: 2025-02-28
 tags:
     - attack.execution
 logsource:
@@ -48,13 +48,14 @@ detection:
         RequestedPolicy:
             - 8
             - 12
-    filter_optional_msoffice:
+    filter_optional_msoffice_1:
         FileNameBuffer|contains: '\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE'
         FileNameBuffer|endswith: '\MSOXMLMF.DLL'
         # ProcessNameBuffer is AV products
         RequestedPolicy: 7
     filter_optional_msoffice_2:
-        ProcessNameBuffer|contains: 'Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office'
+        ProcessNameBuffer|contains: '\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office'
+        FileNameBuffer|contains: '\Windows\System32\'
         RequestedPolicy: 8
     filter_optional_slack:
         # Example: https://user-images.githubusercontent.com/112784902/197407680-96d4b662-8a59-4289-a483-b24d630ac2a9.png