[Rule Tuning] Parent Process PID Spoofing (#2432)

* Update defense_evasion_parent_process_pid_spoofing.toml

* Update defense_evasion_parent_process_pid_spoofing.toml

* Update defense_evasion_parent_process_pid_spoofing.toml

* Update defense_evasion_parent_process_pid_spoofing.toml

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>

rules/windows/defense_evasion_parent_process_pid_spoofing.toml

@@ -3,7 +3,7 @@ creation_date = "2021/07/14"
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2022/08/24"
+updated_date = "2022/12/15"
 
 [rule]
 author = ["Elastic"]
@@ -26,26 +26,42 @@ type = "eql"
 query = '''
 /* This rule is compatible with Elastic Endpoint only */
 
-sequence by host.id, user.id with maxspan=5m
- [process where event.type == "start" and
-  process.Ext.token.integrity_level_name != "system" and
+sequence by host.id, user.id with maxspan=3m 
+
+ [process where event.type == "start" and 
+  process.Ext.token.integrity_level_name != "system" and 
   (
     process.pe.original_file_name : ("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe", "eqnedt32.exe",
                                      "fltldr.exe", "mspub.exe", "msaccess.exe", "powershell.exe", "pwsh.exe",
                                      "cscript.exe", "wscript.exe", "rundll32.exe", "regsvr32.exe", "msbuild.exe",
-                                     "mshta.exe", "wmic.exe", "cmstp.exe", "msxsl.exe") or
-    process.executable : ("?:\\Users\\*.exe",
-                          "?:\\ProgramData\\*.exe",
-                          "?:\\Windows\\Microsoft.NET\\*.exe",
-                          "?:\\Windows\\Temp\\*.exe",
-                          "?:\\Windows\\Tasks\\*") or
-    process.code_signature.trusted != true
-  )
+                                     "mshta.exe", "wmic.exe", "cmstp.exe", "msxsl.exe") or 
+                                     
+    (process.executable : ("?:\\Users\\*.exe",
+                           "?:\\ProgramData\\*.exe",
+                           "?:\\Windows\\Temp\\*.exe",
+                           "?:\\Windows\\Tasks\\*") and 
+      (process.code_signature.exists == false or process.code_signature.status : "errorBadDigest")) or 
+                          
+    process.executable : "?:\\Windows\\Microsoft.NET\\*.exe"                      
+  ) and 
+  
+  not process.executable : 
+             ("?:\\Windows\\System32\\WerFaultSecure.exe", 
+              "?:\\WINDOWS\\SysWOW64\\WerFaultSecure.exe",
+              "?:\\Windows\\System32\\WerFault.exe",
+              "?:\\Windows\\SysWOW64\\WerFault.exe")
   ] by process.pid
- [process where event.type == "start" and process.parent.Ext.real.pid > 0 and
+ [process where event.type == "start" and 
+  process.parent.Ext.real.pid > 0 and 
+ 
   /* process.parent.Ext.real.pid is only populated if the parent process pid doesn't match */
-
-  not (process.name : "msedge.exe" and process.parent.name : "sihost.exe")
+  not (process.name : "msedge.exe" and process.parent.name : "sihost.exe") and 
+  
+   not process.executable : 
+             ("?:\\Windows\\System32\\WerFaultSecure.exe", 
+              "?:\\WINDOWS\\SysWOW64\\WerFaultSecure.exe",
+              "?:\\Windows\\System32\\WerFault.exe",
+              "?:\\Windows\\SysWOW64\\WerFault.exe")
  ] by process.parent.Ext.real.pid
 '''