fixed fps in some rules specifically remote thread creation related

[swachchhanda000]

Summary of the Pull Request

fixed fps in some rules specifically remote thread creation related

Changelog

fix: Uncommon AppX Package Locations: added a new filter to reduce fp noise
fix: Rare Remote Thread Creation By Uncommon Source Image: added new filters to reduce fp noise
fix: Remote Thread Creation By Uncommon Source Image: added new filters to reduce fp noise
update: Remote Thread Created In Shell Application: moved to threat-hunting folder as it was causing so much fp noise

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[swachchhanda000]

As discussed earlier, the Remote Thread Created In Shell Application rule generates a high volume of noise, which is also evident from the goodlog-test results. Therefore, I have moved it to the threat hunting folder.

Regarding the Remote Thread Creation By Uncommon Source Image rule, despite the additional filters applied, I believe there will still be some false positives in real env. This is a concern for a high-level rule. We need to decide whether to lower its severity to low and move it to the threat hunting folder, or completely deprecate it.

The options are either to deprecate the rule or proceed with the current filters as they are. Please share your decision on this.
@frack113 , @nasbench

[nasbench]

As discussed earlier, the Remote Thread Created In Shell Application rule generates a high volume of noise, which is also evident from the goodlog-test results. Therefore, I have moved it to the threat hunting folder.

Regarding the Remote Thread Creation By Uncommon Source Image rule, despite the additional filters applied, I believe there will still be some false positives in real env. This is a concern for a high-level rule. We need to decide whether to lower its severity to low and move it to the threat hunting folder, or completely deprecate it.

The options are either to deprecate the rule or proceed with the current filters as they are. Please share your decision on this. @frack113 , @nasbench

The one you moved to the TH folder needs to have the appropriate tag so please do so.

As for the Remote Thread Creation By Uncommon Source Image. It is stated by the FP string This rule is best put in testing first in order to create a baseline that reflects the data in your environment.. And its already a medium rule its not a high so I dont understand the request

[swachchhanda000]

As discussed earlier, the Remote Thread Created In Shell Application rule generates a high volume of noise, which is also evident from the goodlog-test results. Therefore, I have moved it to the threat hunting folder.
Regarding the Remote Thread Creation By Uncommon Source Image rule, despite the additional filters applied, I believe there will still be some false positives in real env. This is a concern for a high-level rule. We need to decide whether to lower its severity to low and move it to the threat hunting folder, or completely deprecate it.
The options are either to deprecate the rule or proceed with the current filters as they are. Please share your decision on this. @frack113 , @nasbench

The one you moved to the TH folder needs to have the appropriate tag so please do so.

As for the Remote Thread Creation By Uncommon Source Image. It is stated by the FP string This rule is best put in testing first in order to create a baseline that reflects the data in your environment.. And its already a medium rule its not a high so I dont understand the request

Sorry I messed up because of similar names, the rule I was talking about was Rare Remote Thread Creation By Uncommon Source Image. It was noisy and I had to add three new filters just for a single rule. That's was my concern for a high level rule that's it. And thanks for clarification on other rules as well. Much appreciated