Update rules/windows/defense_evasion_msiexec_child_proc_netcon.toml

Co-authored-by: Jonhnathan <[email protected]>

Author: Samirbous

rules/windows/defense_evasion_msiexec_child_proc_netcon.toml

@@ -90,7 +90,7 @@ sequence by process.entity_id with maxspan=1m
          "C:\\Windows\\System32\\wevtutil.exe",
          "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe") and
  not (process.name : ("rundll32.exe", "regsvr32.exe", "powershell.exe", "regasm.exe", "wscript.exe") and process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*")) and
- not (?process.code_signature.subject_name in ("Bruno Software Inc", "Proton AG", "Axis Communications AB", "Citrix Systems, Inc.", "NSUS Limited", "Action1 Corporation", "Solarwinds Worldwide, LLC") and
+ not (?process.code_signature.subject_name : ("Bruno Software Inc", "Proton AG", "Axis Communications AB", "Citrix Systems, Inc.", "NSUS Limited", "Action1 Corporation", "Solarwinds Worldwide, LLC") and
       ?process.code_signature.trusted == true) and
  not (?process.pe.original_file_name in ("dxsetup.exe", "MofCompiler.exe", "ShellApp.exe") and
       ?process.code_signature.subject_name == "Microsoft Corporation" and ?process.code_signature.trusted == true) and