Improve ECS compatibility for endpoint rules

rules/windows/execution_command_shell_started_by_powershell.toml

@@ -1,8 +1,8 @@
 [metadata]
 creation_date = "2020/02/18"
-ecs_version = ["1.4.0"]
+ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/02/18"
+updated_date = "2020/06/24"
 
 [rule]
 author = ["Elastic"]
@@ -18,7 +18,8 @@ tags = ["Elastic", "Windows"]
 type = "query"
 
 query = '''
-process.parent.name:powershell.exe and process.name:cmd.exe
+event.category:process and event.type:(start or process_started) and
+  process.parent.name:powershell.exe and process.name:cmd.exe
 '''