From 9f9f2321de1f4c80cbc9721949188c5380dbee46 Mon Sep 17 00:00:00 2001
From: phantinuss <79651203+phantinuss@users.noreply.github.com>
Date: Tue, 25 Jul 2023 10:17:08 +0200
Subject: [PATCH 1/2] fix: FP found with missing commandlines

---
 ...oc_creation_win_vmware_vmtoolsd_susp_child_process.yml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/rules/windows/process_creation/proc_creation_win_vmware_vmtoolsd_susp_child_process.yml b/rules/windows/process_creation/proc_creation_win_vmware_vmtoolsd_susp_child_process.yml
index 7573e000b..25782d68a 100644
--- a/rules/windows/process_creation/proc_creation_win_vmware_vmtoolsd_susp_child_process.yml
+++ b/rules/windows/process_creation/proc_creation_win_vmware_vmtoolsd_susp_child_process.yml
@@ -7,7 +7,7 @@ references:
     - https://user-images.githubusercontent.com/61026070/136518004-b68cce7d-f9b8-4e9a-9b7b-53b1568a9a94.png
 author: bohops, Bhabesh Raj
 date: 2021/10/08
-modified: 2022/07/14
+modified: 2023/07/25
 tags:
     - attack.execution
     - attack.persistence
@@ -44,6 +44,12 @@ detection:
             - '\VMware\VMware Tools\poweroff-vm-default.bat'
             - '\VMware\VMware Tools\resume-vm-default.bat'
             - '\VMware\VMware Tools\suspend-vm-default.bat'
+    filter_main_empty:
+        Image|endswith: '\cmd.exe'
+        CommandLine: ''
+    filter_main_null:
+        Image|endswith: '\cmd.exe'
+        CommandLine: null
     condition: all of selection* and not 1 of filter_main_*
 falsepositives:
     - Legitimate use by VM administrator

From 250d6c0dd0247c4fc564958eeb7e63df912daac1 Mon Sep 17 00:00:00 2001
From: phantinuss <79651203+phantinuss@users.noreply.github.com>
Date: Tue, 25 Jul 2023 10:17:30 +0200
Subject: [PATCH 2/2] fix: selection to use all strings

---
 .../proc_creation_win_net_use_mount_internet_share.yml         | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/rules/windows/process_creation/proc_creation_win_net_use_mount_internet_share.yml b/rules/windows/process_creation/proc_creation_win_net_use_mount_internet_share.yml
index fcd01b866..75aa985a5 100644
--- a/rules/windows/process_creation/proc_creation_win_net_use_mount_internet_share.yml
+++ b/rules/windows/process_creation/proc_creation_win_net_use_mount_internet_share.yml
@@ -6,6 +6,7 @@ references:
     - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view
 author: Nasreddine Bencherchali (Nextron Systems)
 date: 2023/02/21
+modified: 2023/07/25
 tags:
     - attack.lateral_movement
     - attack.t1021.002
@@ -21,7 +22,7 @@ detection:
             - 'net.exe'
             - 'net1.exe'
     selection_cli:
-        CommandLine|contains:
+        CommandLine|contains|all:
             - ' use '
             - ' http'
     condition: all of selection_*