[Rule Tuning] Exclude Elastic Agent from "Potential Process Herpaderping Attempt" (#2342)

* adjusted query to filter out Elastic or Trend Micro EXE activity

* added wildcard to drive letter and fixed unit test failure

rules/windows/defense_evasion_potential_processherpaderping.toml

@@ -3,7 +3,7 @@ creation_date = "2020/10/27"
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2022/08/24"
+updated_date = "2022/10/05"
 
 [rule]
 author = ["Elastic"]
@@ -25,7 +25,13 @@ type = "eql"
 
 query = '''
 sequence with maxspan=5s
-   [process where event.type == "start" and not process.parent.executable : "C:\\Windows\\SoftwareDistribution\\*.exe"] by host.id, process.executable, process.parent.entity_id
+   [process where event.type == "start" and not process.parent.executable :
+      (
+         "?:\\Windows\\SoftwareDistribution\\*.exe",
+         "?:\\Program Files\\Elastic\\Agent\\data\\*.exe",
+         "?:\\Program Files (x86)\\Trend Micro\\*.exe"
+      )
+   ] by host.id, process.executable, process.parent.entity_id
    [file where event.type == "change" and event.action == "overwrite" and file.extension == "exe"] by host.id, file.path, process.entity_id
 '''