diff --git a/rules/windows/builtin/code_integrity/win_codeintegrity_attempted_dll_load.yml b/rules/windows/builtin/code_integrity/win_codeintegrity_attempted_dll_load.yml
index 9e948ae6a..f9fac4688 100644
--- a/rules/windows/builtin/code_integrity/win_codeintegrity_attempted_dll_load.yml
+++ b/rules/windows/builtin/code_integrity/win_codeintegrity_attempted_dll_load.yml
@@ -11,7 +11,7 @@ references:
     - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
 author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
 date: 2022-01-20
-modified: 2024-08-29
+modified: 2024-10-08
 tags:
     - attack.execution
 logsource:
@@ -99,6 +99,11 @@ detection:
         FileNameBuffer|endswith: '\Program Files\ESET\ESET Security\eamsi.dll'
     filter_optional_comodo:
         FileNameBuffer|endswith: '\Program Files\comodo\comodo internet security\amsiprovider_x64.dll'
+    filter_optional_sentinel_one:
+        # Example: program files\sentinelone\sentinel agent 23.4.4.223\inprocessclient64.dll
+        - FileNameBuffer|contains: '\Program Files\SentinelOne\Sentinel Agent'
+        # Example: Program Files\SentinelOne\Sentinel Agent 23.4.4.223\SentinelAgent.exe
+        - ProcessNameBuffer|contains: '\Program Files\SentinelOne\Sentinel Agent'
     condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
 falsepositives:
     - Antivirus and other third party products are known to trigger this rule quite a lot. Initial filters and tuning is required before using this rule.
diff --git a/rules/windows/powershell/powershell_classic/posh_pc_renamed_powershell.yml b/rules/windows/powershell/powershell_classic/posh_pc_renamed_powershell.yml
index 2c4b03ef9..329717393 100644
--- a/rules/windows/powershell/powershell_classic/posh_pc_renamed_powershell.yml
+++ b/rules/windows/powershell/powershell_classic/posh_pc_renamed_powershell.yml
@@ -1,15 +1,17 @@
 title: Renamed Powershell Under Powershell Channel
 id: 30a8cb77-8eb3-4cfb-8e79-ad457c5a4592
 status: test
-description: Detects renamed powershell
+description: |
+    Detects a renamed Powershell execution, which is a common technique used to circumvent security controls and bypass detection logic that's dependent on process names and process paths.
 references:
     - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
 author: Harish Segar, frack113
 date: 2020-06-29
-modified: 2023-10-27
+modified: 2024-10-08
 tags:
     - attack.execution
     - attack.t1059.001
+    - attack.t1036.003
 logsource:
     product: windows
     category: ps_classic_start
@@ -25,6 +27,10 @@ detection:
             # In some cases powershell was invoked with inverted slashes
             - 'HostApplication=C:/Windows/System32/WindowsPowerShell/v1.0/powershell'
             - 'HostApplication=C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell'
+    filter_main_host_application_null:
+        # Note: Since we're using the raw data field to match. There is no easy way to filter out cases where the "HostApplication" field is null (i.e doesn't exist). We're practically forced to use a regex.
+        # If you're already mapping and extracting the field, then obviously use that directly.
+        Data|re: 'HostId=[a-zA-Z0-9-]{36} EngineVersion='
     condition: selection and not 1 of filter_main_*
 falsepositives:
     - Unknown
diff --git a/rules/windows/powershell/powershell_classic/posh_pc_wsman_com_provider_no_powershell.yml b/rules/windows/powershell/powershell_classic/posh_pc_wsman_com_provider_no_powershell.yml
index 3ce5fb0c8..41f34de78 100644
--- a/rules/windows/powershell/powershell_classic/posh_pc_wsman_com_provider_no_powershell.yml
+++ b/rules/windows/powershell/powershell_classic/posh_pc_wsman_com_provider_no_powershell.yml
@@ -8,7 +8,7 @@ references:
     - https://github.com/bohops/WSMan-WinRM
 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
 date: 2020-06-24
-modified: 2023-10-27
+modified: 2024-10-08
 tags:
     - attack.execution
     - attack.t1059.001
@@ -28,6 +28,10 @@ detection:
             # In some cases powershell was invoked with inverted slashes
             - 'HostApplication=C:/Windows/System32/WindowsPowerShell/v1.0/powershell'
             - 'HostApplication=C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell'
+    filter_main_host_application_null:
+        # Note: Since we're using the raw data field to match. There is no easy way to filter out cases where the "HostApplication" field is null (i.e doesn't exist). We're practically forced to use a regex.
+        # If you're already mapping and extracting the field, then obviously use that directly.
+        Data|re: 'HostId=[a-zA-Z0-9-]{36} EngineVersion='
     condition: selection and not 1 of filter_main_*
 falsepositives:
     - Unknown