Merge pull request #521 from Neo23x0/devel

fix: fixed false positive in suspicious shell spawn rule

rules/windows/builtin/win_susp_add_sid_history.yml

@@ -25,4 +25,4 @@ detection:
     condition: selection1 or (selection2 and not selection3)
 falsepositives:
     - Migration of an account into a new domain
-level: medium
+level: low

rules/windows/process_creation/win_shell_spawn_susp_program.yml

@@ -18,7 +18,7 @@ detection:
         ParentImage:
             - '*\mshta.exe'
             - '*\powershell.exe'
-            - '*\cmd.exe'
+            # - '*\cmd.exe'  # too many false positives
             - '*\rundll32.exe'
             - '*\cscript.exe'
             - '*\wscript.exe'