Update defense_evasion_whitespace_padding_command_line.toml

Author: Samirbous

rules/windows/defense_evasion_whitespace_padding_command_line.toml

@@ -77,6 +77,7 @@ tags = [
     "Use Case: Threat Detection",
     "Tactic: Defense Evasion",
     "Tactic: Execution",
+    "Resources: Investigation Guide"
 ]
 timestamp_override = "event.ingested"
 type = "esql"
@@ -87,7 +88,7 @@ FROM logs-* metadata _id, _version, _index
 // more than 100 spaces in process.command_line
 | eval multi_spaces = LOCATE(process.command_line, space(100)) 
 | where multi_spaces > 0 
-| keep user.name, host.id, host.name, process.command_line
+| keep user.name, host.id, host.name, process.command_line, process.executable, process.parent.executable
 '''