Update proc_creation_win_powershell_non_interactive_execution.yml

Author: nasbench

rules/windows/process_creation/proc_creation_win_powershell_non_interactive_execution.yml

@@ -6,7 +6,7 @@ references:
     - https://web.archive.org/web/20200925032237/https://threathunterplaybook.com/notebooks/windows/02_execution/WIN-190410151110.html
 author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements)
 date: 2019-09-12
-modified: 2023-09-07
+modified: 2025-02-28
 tags:
     - attack.execution
     - attack.t1059.001
@@ -26,7 +26,6 @@ detection:
             - ':\Windows\explorer.exe'
             - ':\Windows\System32\CompatTelRunner.exe'
             - ':\Windows\SysWOW64\explorer.exe'
-            - ':\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe'
     filter_main_windows_update:
         ParentImage: ':\$WINDOWS.~BT\Sources\SetupHost.exe' # During Windows updates/upgrades
         # CommandLine: powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';
@@ -37,6 +36,8 @@ detection:
     filter_optional_terminal:
         ParentImage|contains: ':\Program Files\WindowsApps\Microsoft.WindowsTerminal_'
         ParentImage|endswith: '\WindowsTerminal.exe'
+    filter_optional_defender:
+        ParentImage|endswith: ':\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe'
     condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
 falsepositives:
     - Likely. Many admin scripts and tools leverage PowerShell in their BAT or VB scripts which may trigger this rule often. It is best to add additional filters or use this to hunt for anomalies