Updated per suggestions

Author: djlukic

rules/windows/powershell/powershell_classic/posh_pc_wsman_com_provider_no_powershell.yml

@@ -33,7 +33,7 @@ detection:
         # If you're already mapping and extracting the field, then obviously use that directly.
         Data|re: 'HostId=[a-zA-Z0-9-]{36}\s+EngineVersion='
     filter_main_hexnode:
-        Data|contains: 'HostApplication=C:\Hexnode\Hexnode'
+        Data|contains: 'HostApplication=C:\Hexnode\Hexnode Agent\Current\HexnodeAgent.exe'
     condition: selection and not 1 of filter_main_*
 falsepositives:
     - Unknown

rules/windows/powershell/powershell_script/posh_ps_susp_set_alias.yml

@@ -25,19 +25,19 @@ detection:
             - 'Set-Alias '
             - 'New-Alias '
     filter_main_cim:
-        ScriptBlockText|contains:
-            - ' -Name ncms -Value New-CimSession '
-            - ' -Name gcls -Value Get-CimClass '
-            - ' -Name ncso -Value New-CimSessionOption '
-            - ' -Name gcms -Value Get-CimSession '
-            - ' -Name rcms -Value Remove-cimSession '
-            - ' -Name rcie -Value Register-CimIndicationEvent '
-            - ' -Name gcai -Value Get-CimAssociatedInstance '
-            - ' -Name gcim -Value Get-CimInstance '
-            - ' -Name scim -Value Set-CimInstance '
-            - ' -Name ncim -Value New-CimInstance '
-            - ' -Name rcim -Value Remove-cimInstance '
-            - ' -Name icim -Value Invoke-CimMethod '
+        ScriptBlockText:
+            - 'Set-Alias -Name ncms -Value New-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue'
+            - 'Set-Alias -Name gcls -Value Get-CimClass -Option ReadOnly, AllScope -ErrorAction SilentlyContinue'
+            - 'Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue'
+            - 'Set-Alias -Name gcms -Value Get-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue'
+            - 'Set-Alias -Name rcms -Value Remove-cimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue'
+            - 'Set-Alias -Name rcie -Value Register-CimIndicationEvent -Option ReadOnly, AllScope -ErrorAction SilentlyContinue'
+            - 'Set-Alias -Name gcai -Value Get-CimAssociatedInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue'
+            - 'Set-Alias -Name gcim -Value Get-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue'
+            - 'Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue'
+            - 'Set-Alias -Name ncim -Value New-CimInstance  -Option ReadOnly, AllScope -ErrorAction SilentlyContinue'
+            - 'Set-Alias -Name rcim -Value Remove-cimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue'
+            - 'Set-Alias -Name icim -Value Invoke-CimMethod -Option ReadOnly, AllScope -ErrorAction SilentlyContinue'
     condition: selection and not 1 of filter_main_*
 falsepositives:
     - Unknown