Fix Issues 6.4 Batch

[nasbench]

This PR fixes a couple of issues reported by the community through GH and E-mail, as well as a bunch of other issues identified by STRT.

[tccontre]

LGTM

[Copilot]

Pull request overview

This PR updates multiple Splunk Security Content detection YAMLs to address community/STRT-reported issues by improving analytic metadata readability, refining SPL searches, and expanding coverage (tests/references/technique mappings) in several endpoint detections.

Changes:

• Reformats several analytics’ description, how_to_implement, and known_false_positives fields into block scalars for readability/consistency.
• Refines SPL searches (e.g., IN (...) lists, AccessMask bit checks, updated exclusions) and updates finding/intermediate finding messages.
• Expands coverage and context via additional references and (in at least one analytic) additional test cases / ATT&CK technique coverage.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
detections/endpoint/windows_user_discovery_via_net.yml	Refactors SPL formatting, expands to include domain discovery context, adds additional ATT&CK mapping and test.
detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml	Refactors SPL formatting and updates finding/intermediate finding messaging.
detections/endpoint/windows_disable_shutdown_button_through_registry.yml	Refactors SPL formatting and improves intermediate finding message and references.
detections/endpoint/network_share_discovery_via_dir_command.yml	Refactors SPL and adds AccessMask bit logic plus updated references.
detections/endpoint/high_frequency_copy_of_files_in_network_share.yml	Refactors SPL and adds AccessMask bit logic; updates intermediate finding messaging.
detections/endpoint/executable_file_written_in_administrative_smb_share.yml	Refactors SPL, expands targeted extensions, and updates finding title formatting and references.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[tccontre]

looks good

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

Suppressed comments (2)

detections/endpoint/network_share_discovery_via_dir_command.yml:49

• The known_false_positives text has a grammatical error ("administrations tasks"). This should be "administrative tasks" (or similar) for clarity.

known_false_positives: |-
    System Administrators may use tools like "net.exe", "net1.exe", or "dir" for troubleshooting or administrations tasks.
    However, this will typically come only from certain users and certain systems that can be added to an allow list.

detections/endpoint/executable_file_written_in_administrative_smb_share.yml:46

• The known_false_positives text has a grammatical error ("administrations tasks"). This should be "administrative tasks" for clarity and professionalism.

known_false_positives: |-
    System Administrators may use tools like PsExec for troubleshooting or administrations tasks. However, this will typically come only from certain users and certain systems that can be added to an allow list.