[Rule Tuning] Privileges Elevation via Parent Process PID Spoofing (#2873)

* Update privilege_escalation_via_ppid_spoofing.toml

* Update privilege_escalation_via_ppid_spoofing.toml

* bump date

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

rules/windows/privilege_escalation_via_ppid_spoofing.toml

@@ -4,7 +4,7 @@ integration = ["endpoint"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2023/06/22"
+updated_date = "2023/06/23"
 
 [rule]
 author = ["Elastic"]
@@ -49,6 +49,11 @@ process where host.os.type == "windows" and event.action == "start" and
                            "?:\\Windows\\System32\\Wermgr.exe",
                            "?:\\Windows\\SysWOW64\\Wermgr.exe",
                            "?:\\Windows\\SoftwareDistribution\\Download\\Install\\securityhealthsetup.exe") and
+ /* Logon Utilities */
+ not (process.parent.executable : "?:\\Windows\\System32\\Utilman.exe" and
+     process.executable : ("?:\\Windows\\System32\\osk.exe", 
+                           "?:\\Windows\\System32\\Narrator.exe", 
+                           "?:\\Windows\\System32\\Magnify.exe")) and
 
  not process.parent.executable : "?:\\Windows\\System32\\AtBroker.exe" and