[Rule Tuning] Process Termination followed by Deletion (#2206)

Excluded some FPs by process.executable and file.path.

(cherry picked from commit 91896db453)

rules/windows/defense_evasion_process_termination_followed_by_deletion.toml

@@ -1,7 +1,7 @@
 [metadata]
 creation_date = "2020/11/04"
 maturity = "production"
-updated_date = "2021/09/23"
+updated_date = "2022/08/01"
 
 [rule]
 author = ["Elastic"]
@@ -28,7 +28,14 @@ sequence by host.id with maxspan=5s
     process.code_signature.trusted == false and
     not process.executable : ("C:\\Windows\\SoftwareDistribution\\*.exe", "C:\\Windows\\WinSxS\\*.exe")
    ] by process.executable
-   [file where event.type == "deletion" and file.extension : ("exe", "scr", "com")] by file.path
+   [file where event.type == "deletion" and file.extension : ("exe", "scr", "com") and
+    not process.executable :
+             ("?:\\Program Files\\*.exe",
+              "?:\\Program Files (x86)\\*.exe",
+              "?:\\Windows\\System32\\svchost.exe",
+              "?:\\Windows\\System32\\drvinst.exe") and
+    not file.path : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe")
+   ] by file.path
 '''