refactor: additional pattern, extended description

rules/windows/process_creation/win_apt_revil_kaseya.yml

@@ -1,7 +1,7 @@
 title: REvil Kaseya Incident Malware Patterns
 id: 5de632bc-7fbd-4c8a-944a-fce55c59eae5
 status: experimental
-description: Detects process command line patterns and locations used by REvil group in Kaseya incident
+description: Detects process command line patterns and locations used by REvil group in Kaseya incident (can also match on other malware)
 references:
     - https://community.sophos.com/b/security-blog/posts/active-ransomware-attack-on-kaseya-customers
     - https://www.joesandbox.com/analysis/443736/0/html
@@ -22,6 +22,7 @@ detection:
             - 'Set-MpPreference -DisableRealtimeMonitoring $true -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled'
             - 'del /q /f c:\kworking\agent.crt'
             - 'Kaseya VSA Agent Hot-fix'
+            - '\AppData\Local\Temp\MsMpEng.exe'
     selection2:
         Image: 
             - 'C:\Windows\MsMpEng.exe'