Improve ECS compatibility for endpoint rules

rules/windows/execution_script_executing_powershell.toml

@@ -1,8 +1,8 @@
 [metadata]
 creation_date = "2020/02/18"
-ecs_version = ["1.4.0"]
+ecs_version = ["1.5.0"]
 maturity = "production"
-updated_date = "2020/02/18"
+updated_date = "2020/06/24"
 
 [rule]
 author = ["Elastic"]
@@ -21,7 +21,9 @@ tags = ["Elastic", "Windows"]
 type = "query"
 
 query = '''
-event.action:"Process Create (rule: ProcessCreate)" and process.parent.name:(cscript.exe or wscript.exe) and process.name:powershell.exe
+event.category:process and event.type:(start or process_started) and
+  process.parent.name:(cscript.exe or wscript.exe) and
+  process.name:powershell.exe
 '''