Another snapattack windows batch

[RavenTait]

Details

This PR adds multiple new detections converted from Snap Attack. Below is a detailed summary of the changes introduced by the review.

New Analytics [4]

Multiple analytics (a total of 4) have been added in this PR covering several techniques.

• Windows Dir Piped to Findstr Activity
• Windows Network Sniffing Tool Executed
• Windows Powershell Commands from DNS TXT
• Windows Suspicious Child Process of Consent.EXE

Updated Lookups [1]

Netscan added to attacker_tools lookup

[Copilot]

Pull request overview

This pull request adds new Windows endpoint detections converted from Snap Attack and expands the attacker tooling lookup to improve coverage for common discovery and execution behaviors.

Changes:

• Added 4 new endpoint detection analytics for Windows process and PowerShell behaviors.
• Updated the attacker_tools lookup to include netscan.exe.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
lookups/csv/attacker_tools.csv	Adds netscan.exe to the attacker tools lookup to improve enrichment/triage.
detections/endpoint/windows_suspicious_child_of_consent_exe.yml	New analytic for unexpected child processes spawned by consent.exe (UAC bypass signal).
detections/endpoint/windows_powershell_commands_from_dns_txt.yml	New analytic for PowerShell script-block patterns indicative of DNS TXT–based command retrieval/execution.
detections/endpoint/windows_network_sniffing_tools.yml	New analytic for executions of common Windows packet capture/sniffing utilities.
detections/endpoint/windows_dir_piped_to_findstr_activity.yml	New analytic for dir piped to findstr reconnaissance activity.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[nasbench]

Had to reduce Windows Dir Piped to Findstr Activity to hunting due to large amount of FPs and few metadata tweaks here and there.