From eaa510afdf153472cd4a4218e3df2e613d06dce7 Mon Sep 17 00:00:00 2001
From: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
Date: Mon, 6 Apr 2026 09:42:29 -0300
Subject: [PATCH] [Rule Tuning] Misc Windows (#5906)

(cherry picked from commit 0a8c89d3f5c7a09b09e6f3cac98c97311b31094e)
---
 rules/windows/defense_evasion_posh_high_entropy.toml | 12 ++++++++----
 .../execution_psexec_lateral_movement_command.toml   |  7 ++++---
 2 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/rules/windows/defense_evasion_posh_high_entropy.toml b/rules/windows/defense_evasion_posh_high_entropy.toml
index 1c33761d1..11056419c 100644
--- a/rules/windows/defense_evasion_posh_high_entropy.toml
+++ b/rules/windows/defense_evasion_posh_high_entropy.toml
@@ -2,7 +2,7 @@
 creation_date = "2026/01/08"
 integration = ["windows"]
 maturity = "production"
-updated_date = "2026/03/24"
+updated_date = "2026/03/31"
 
 [rule]
 author = ["Elastic"]
@@ -128,8 +128,11 @@ type = "query"
 
 query = '''
 event.category:process and host.os.type:windows and powershell.file.script_block_length > 1000 and
-  powershell.file.script_block_entropy_bits >= 5.3 and powershell.file.script_block_surprisal_stdev > 0.7 and
-  not file.directory: "C:\Program Files (x86)\Microsoft Intune Management Extension\Content\DetectionScripts"
+  powershell.file.script_block_entropy_bits >= 5.5 and powershell.file.script_block_surprisal_stdev > 0.7 and
+  not file.directory: (
+        "C:\Program Files (x86)\Microsoft Intune Management Extension\Content\DetectionScripts" or
+        "C:\Program Files\Microsoft Azure AD Connect Health Agent\Products\AdFederationService\AdfsDiagnostics\AdfsToolbox\diagnosticsModule\Private"
+  )
 '''
 
 
@@ -138,7 +141,7 @@ event.category:process and host.os.type:windows and powershell.file.script_block
 negate = true
 [rule.filters.query.wildcard."file.path"]
 case_insensitive = true
-value = "?:\\\\ProgramData\\\\Microsoft\\\\Windows Defender Advanced Threat Protection\\\\DataCollection\\\\*"
+value = "?:\\\\ProgramData\\\\Microsoft\\\\Windows Defender Advanced Threat Protection\\\\*"
 
 [[rule.threat]]
 framework = "MITRE ATT&CK"
@@ -180,6 +183,7 @@ reference = "https://attack.mitre.org/techniques/T1059/001/"
 id = "TA0002"
 name = "Execution"
 reference = "https://attack.mitre.org/tactics/TA0002/"
+
 [rule.investigation_fields]
 field_names = [
     "@timestamp",
diff --git a/rules/windows/execution_psexec_lateral_movement_command.toml b/rules/windows/execution_psexec_lateral_movement_command.toml
index c567451cf..49d1fbb0d 100644
--- a/rules/windows/execution_psexec_lateral_movement_command.toml
+++ b/rules/windows/execution_psexec_lateral_movement_command.toml
@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
 maturity = "production"
-updated_date = "2025/08/26"
+updated_date = "2026/03/31"
 
 [rule]
 author = ["Elastic"]
@@ -77,7 +77,8 @@ type = "eql"
 
 query = '''
 sequence by process.entity_id
-  [process where host.os.type == "windows" and process.name : "PsExec.exe" and event.type == "start" and
+  [process where host.os.type == "windows" and event.type == "start" and
+   (process.name : "PsExec.exe" or ?process.pe.original_file_name : "psexec.c") and
 
    /* This flag suppresses the display of the license dialog and may
       indicate that psexec executed for the first time in the machine */
@@ -88,7 +89,7 @@ sequence by process.entity_id
                              "?:\\Program Files\\Docusnap X\\Bin\\psexec.exe",
                              "?:\\Program Files\\Docusnap X\\Tools\\dsDNS.exe") and
    not process.parent.executable : "?:\\Program Files (x86)\\Cynet\\Cynet Scanner\\CynetScanner.exe"]
-  [network where host.os.type == "windows" and process.name : "PsExec.exe"]
+  [network where host.os.type == "windows"]
 '''