Update lateral_movement_credential_access_kerberos_correlation.toml (#5455)

Co-authored-by: Jonhnathan <[email protected]>

(cherry picked from commit 2cc1a34)

Author: Samirbous

rules/windows/lateral_movement_credential_access_kerberos_correlation.toml

@@ -2,7 +2,7 @@
 creation_date = "2025/10/28"
 integration = ["endpoint", "windows", "system"]
 maturity = "production"
-updated_date = "2025/11/25"
+updated_date = "2025/12/12"
 
 [rule]
 author = ["Elastic"]
@@ -84,10 +84,11 @@ type = "eql"
 query = '''
 sequence by source.port, source.ip with maxspan=3s
  [network where host.os.type == "windows" and destination.port == 88 and
-  process.executable != null and
+  process.executable != null and process.pid != 4 and 
   not process.executable : 
               ("?:\\Windows\\system32\\lsass.exe", 
-               "\\device\\harddiskvolume*\\windows\\system32\\lsass.exe") and
+               "\\device\\harddiskvolume*\\windows\\system32\\lsass.exe", 
+               "\\device\\harddiskvolume*\\windows\\system32\\svchost.exe") and
   not (process.executable : ("C:\\Windows\\System32\\svchost.exe", 
                              "C:\\Program Files\\VMware\\VMware View\\Server\\bin\\ws_TomcatService.exe", 
                              "F:\\IGEL\\RemoteManager\\*\\bin\\tomcat10.exe") and user.id in ("S-1-5-20", "S-1-5-18")) and