Fix Mint Sandstorm - Log4J Wstomcat Process Execution Condition

[0x616c6578]

Fixed detection condition in c97c625-0350-4f0a-8943-f6cadc88125e

The MSTIC reference provides the following KQL query for Log4J Wstomcat Process Execution:

DeviceProcessEvents
| where InitiatingProcessFileName has "ws_tomcatservice.exe" and FileName !in~("repadmin.exe")

The current version of c97c625-0350-4f0a-8943-f6cadc88125e treats the !in~ operator as an in~ operator, causing the rule to trigger on false positive events:

detection:
    selection:
        ParentImage|endswith: '\ws_tomcatservice.exe'
        Image|endswith: '\repadmin.exe'
    condition: selection

This PR changes it to the following:

detection:
    selection:
        ParentImage|endswith: '\ws_tomcatservice.exe'
    filter:
        Image|endswith: '\repadmin.exe'
    condition: selection and not filter

Changelog

fix: Mint Sandstorm - Log4J Wstomcat Process Execution - Add missing filter

Example Log Event

N/A

Fixed Issues

N/A

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions