[Rule Tuning] Potential Command and Control via Internet Explorer (#1771)

* Use user.name on the sequence instead of user.id

* Update command_and_control_iexplore_via_com.toml

* Remove min_stack and comment "with runs"

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

rules/windows/command_and_control_iexplore_via_com.toml

@@ -1,7 +1,7 @@
 [metadata]
 creation_date = "2020/11/28"
 maturity = "production"
-updated_date = "2021/09/23"
+updated_date = "2022/02/14"
 
 [rule]
 author = ["Elastic"]
@@ -23,7 +23,7 @@ tags = ["Elastic", "Host", "Windows", "Threat Detection", "Command and Control"]
 type = "eql"
 
 query = '''
-sequence by host.id, user.id with maxspan = 5s
+sequence by host.id, user.name with maxspan = 5s
   [library where dll.name : "IEProxy.dll" and process.name : ("rundll32.exe", "regsvr32.exe")]
   [process where event.type == "start" and process.parent.name : "iexplore.exe" and process.parent.args : "-Embedding"]
   /* IE started via COM in normal conditions makes few connections, mainly to Microsoft and OCSP related domains, add FPs here */
@@ -40,7 +40,7 @@ sequence by host.id, user.id with maxspan = 5s
     "*.office365.com",
     "*.office.com"
     )
-  ]
+  ] /* with runs=5 */
 '''