Regex improvement on Powershell rules

[djlukic]

Summary of the Pull Request

Hi,

Proposing a regex fix for following rules:

1. 30a8cb77-8eb3-4cfb-8e79-ad457c5a4592
2. df9a0e0e-fedb-4d6c-8668-d765dfc92aa7

Changelog

Regex condition update for following rules:

• Suspicious Non PowerShell WSMAN COM Provider
• Renamed Powershell Under Powershell Channel

Example Log Event

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="PowerShell" /> 
  <EventID Qualifiers="0">400</EventID> 
  <Level>4</Level> 
  <Task>4</Task> 
  <Keywords>0x80000000000000</Keywords> 
  <TimeCreated SystemTime="2024-12-01T14:26:10.0000000Z" /> 
  <EventRecordID>3079110</EventRecordID> 
  <Channel>Windows PowerShell</Channel> 
  <Computer>McServer.mcdermott.local</Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data>Available</Data> 
  <Data>None</Data> 
  <Data>NewEngineState=Available PreviousEngineState=None SequenceNumber=37 HostName=RunspaceHost HostVersion=15.0.0.0 HostId=9d15ca57-8227-4b5f-a365-fed71ccb085b EngineVersion=3.0 RunspaceId=5e473451-e6ff-4eba-b8d8-c96c5fe84509 PipelineId= CommandName= CommandType= ScriptName= CommandPath= CommandLine=</Data> 
  </EventData>
  </Event>

Fixed Issues

Above Example of Log Event is beautified view from Event Viewer.

However after HostId=9d15ca57-8227-4b5f-a365-fed71ccb085b there is no whitespace but \r\n\t. I checked this in many EVTX parsers to be sure and all of them have \r\n\t.

Windows Powershell.evtx in HxD shows the same.

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[nasbench]

My original logs matched accurately on this using a custom parser. Hence changing this to \s+ should cover all cases.

Also @djlukic please update the modified date.

[frack113]

Regex is good to me, only miss to update the modified date.