Fixed more fps

[swachchhanda000]

Summary of the Pull Request

This makes a little change on Python Initiated Connection rule to reduce the false positive

Changelog

fix: Python Initiated Connection: modified the image to remove the fp
fix: Potential Binary Or Script Dropper Via PowerShell: added filters to remove fp
fix: Potential WinAPI Calls Via CommandLine: added filters to remove fp
fix: Elevated System Shell Spawned From Uncommon Parent Location: Added new filter for parentimage with '-' value
fix: Windows Processes Suspicious Parent Directory: Added new filter for parentimage with '-' value
fix: Whoami.EXE Execution Anomaly: Added new filter for parentimage with '-' value
fix: Conhost Spawned By Uncommon Parent Process: Added filter for new type of svchost parentcommandline
update: Elevated System Shell Spawned: Added powershell_ise.exe

Example Log Event

1. Python Initiated Connection

This rule cause fp for me when you don't have python accessible in your cmd env, then it redirects you to windows app store portal to download the python.

2. Potential Binary Or Script Dropper Via PowerShell

3. Potential WinAPI Calls Via CommandLine:

](url)

4. Elevated System Shell Spawned From Uncommon Parent Location

5. Conhost Spawned By Uncommon Parent Process

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[frack113]

LGTM
As C:\Windows\SystemTemp\ is proteted by design , the filter should not open up opportunities for attackers to bypass the rule.