fix(rules): Reduce Suspicious LSASS process access FPs

Author: rabbitstack

rules/credential_access_suspicious_lsass_process_access.yml

@@ -1,6 +1,6 @@
 name: Suspicious LSASS process access
 id: 40e59763-62c6-4ae7-8c8a-5d4167d3b4e9
-version: 1.0.0
+version: 1.0.1
 description: |
   Identifies processes requesting high-privilege access to the
   Local Security Authority Subsystem Service (LSASS) process
@@ -35,12 +35,15 @@ condition: >
               '?:\\Windows\\system32\\MRT.exe',
               '?:\\Windows\\System32\\wininit.exe',
               '?:\\Windows\\System32\\services.exe',
+              '?:\\WINDOWS\\System32\\taskhostw.exe',
               '?:\\Windows\\Sysmon.exe',
               '?:\\Windows\\Sysmon64.exe',
               '?:\\Windows\\System32\\msiexec.exe',
               '?:\\Windows\\system32\\wbem\\wmiprvse.exe',
               '?:\\ProgramData\\Microsoft\\Windows Defender\\*\\MsMpEng.exe'
-            )
+            ) and
+  not (ps.exe imatches '?:\\Windows\\System32\\lsass.exe' and ps.parent.exe imatches '?:\\Windows\\System32\\wininit.exe') and
+  not (thread.callstack.final_user_module.signature.trusted = true and thread.callstack.final_user_module.signature.subject imatches '*Microsoft Corporation*' and thread.callstack.modules not imatches ('*dbgcore.dll', '*comsvcs.dll'))
 
 severity: high